Quality-review polish: a one-line comment over the empty-updates guard in reinstateInvite explains why removing it would re-leak a confusing Drizzle error. A new test verifies that when Path A (revoked->active) fails its post-state check, the original token is preserved by the SQLite transaction rollback (not replaced by the would-be new token).