- GET /api/lists scoped access tests (empty, owned, shared, D-04 negative) - GET /api/lists item count (activeCount/doneCount) assertion - POST /api/lists shared/private create + auto list_shares + zod validation - DELETE /api/lists/:id owner/403/404/cascade tests - PATCH /api/lists/:id rename/share toggle/403/zod tests - All fail 404 (router not yet mounted) — RED gate confirmed