docs: reorder & testing

backend/internal/server/handlers_user_games.go

@@ -116,15 +116,20 @@ func (h *UserGamesHandlers) Orders() gin.HandlerFunc {
 			respondGameProxyError(c, h.logger, "user games orders", ctx, err)
 			return
 		}
-		// Orders payload uses an updatedAt + commands shape; we don't
-		// rewrite it here because the engine derives the actor from
-		// the route, not the order body. We pass the body through
-		// verbatim (per ARCHITECTURE.md §9: backend is the only
-		// caller, so rewriting is unnecessary). Unused mapping is
-		// kept in the lookup so 404 returns when no mapping exists.
-		_ = mapping
+		// Engine binds the order body into `gamerest.Command{Actor,
+		// Commands}` and rejects an empty actor with `notblank`, so
+		// backend rebinds the actor from the runtime player mapping
+		// before forwarding — the same rule as for the command
+		// handler. Per ARCHITECTURE.md §9 backend is the only caller
+		// of the engine, so the body never carries a client-supplied
+		// actor.
 		_ = order.Order{}
-		resp, err := h.engine.PutOrders(ctx, endpoint, body)
+		payload, err := rebindActor(body, mapping.RaceName)
+		if err != nil {
+			httperr.Abort(c, http.StatusBadRequest, httperr.CodeInvalidRequest, "request body must be a JSON object")
+			return
+		}
+		resp, err := h.engine.PutOrders(ctx, endpoint, payload)
 		if err != nil {
 			respondEngineProxyError(c, h.logger, "user games orders", ctx, resp, err)
 			return