feat: guard against empty terms in createGameSession

documentation/tickets/t00007.md

@@ -0,0 +1,41 @@
+# feat: guard against empty terms in createGameSession
+
+## Problem
+
+If `getGameTerms` returned an empty array — no vocabulary data matched the requested language, difficulty, and part of speech combination — `createGameSession` would create a session with zero questions and return it. The frontend would receive an empty `questions` array, attempt to render the first question, find nothing, and crash with no useful error message shown to the user.
+
+## Options considered
+
+### Option A — `NotFoundError` (404) ✅
+
+Throw when `terms.length === 0` before any session is created. The combination of filters yielded no data — that's a "not found" situation.
+
+Chosen because: the request is technically valid (all filter values are recognised), but the combination has no matching data. 404 is the correct semantic response.
+
+### Option B — `ValidationError` (400)
+
+Treat empty results as a bad request.
+
+Rejected because: the client sent valid input. The problem is missing data, not invalid input. 400 would be misleading.
+
+## Solution
+
+Added a guard in `createGameSession` immediately after `getGameTerms`:
+
+```ts
+if (terms.length === 0) {
+  throw new NotFoundError("No terms found for the given filters");
+}
+```
+
+The error propagates through the controller's `try/catch` to the error handler, which returns a clean 404 response. No session is created.
+
+## Files changed
+
+- `apps/api/src/services/gameService.ts` — empty terms guard added
+- `apps/api/src/services/gameService.test.ts` — pinning test added
+- `apps/api/src/controllers/gameController.test.ts` — pinning test added at HTTP layer
+
+## Commit
+
+`feat: guard against empty terms in createGameSession`