Finalize API envelopes and close validation drift tasks

GameList.Tests/StateTests.cs

@@ -212,7 +212,7 @@ public class StateTests
         await using var factory = new TestWebApplicationFactory();
         var anon = factory.CreateClient();
         var unauthorized = await anon.GetAsync("/api/state");
-        Assert.NotEqual(HttpStatusCode.OK, unauthorized.StatusCode);
+        Assert.Equal(HttpStatusCode.Unauthorized, unauthorized.StatusCode);
 
         var client = factory.CreateClientWithCookies();
         await client.RegisterAsync("counting");
@@ -224,6 +224,27 @@ public class StateTests
         Assert.True(suggestions.GetInt32() >= 1);
     }
 
+    [Fact]
+    public async Task State_endpoint_with_stale_cookie_returns_unauthorized_and_clears_cookie()
+    {
+        await using var factory = new TestWebApplicationFactory();
+        var client = factory.CreateClientWithCookies();
+        await client.RegisterAsync("stale");
+
+        await factory.WithDbContextAsync(async db =>
+        {
+            var player = await db.Players.FirstAsync();
+            db.Players.Remove(player);
+            await db.SaveChangesAsync();
+        });
+
+        var resp = await client.GetAsync("/api/state");
+
+        Assert.Equal(HttpStatusCode.Unauthorized, resp.StatusCode);
+        Assert.True(resp.Headers.TryGetValues("Set-Cookie", out var cookies));
+        Assert.Contains(cookies, c => c.Contains("player=", StringComparison.OrdinalIgnoreCase));
+    }
+
     [Fact]
     public async Task Health_endpoint_ok()
     {