[blackheaven]

https://wearezeta.atlassian.net/browse/WPB-29581

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[akshaymankar]

Partial review. I haven't looked deeper into queries and DB design yet.

[blackheaven]

Addressed the review asks, mirroring the connections migration (#5685):

• No unlocked bulk copy: the copy loop now works per team (SELECT DISTINCT team scan). For each team it takes the exclusive per-team migration lock (withExclusiveMigrationLockAndTimeout, shared migrationOptions.timeout), re-reads the team's team_invitation and team_scim_pending_user_email rows from Cassandra inside the lock, upserts them into Postgres, and — only if every row copied without error — deletes the copied Cassandra partitions (including the denormalized team_invitation_info / team_invitation_email index rows) in the same locked section. A failed row leaves the team untouched and the loop retries the team on the next pass; the SELECT DISTINCT team re-scan is the crash recovery.
• No unserialized writes: every mutation in migration-to-postgresql mode (insert, delete invitation, delete-all, SCIM pending-user insert/delete) is mirrored to both stores under the shared per-team lock, so nothing can resurrect a deleted invitation or land in Cassandra only after the copier cleared its partition.
• Reads route through Postgres under a shared lock: each read takes the shared per-team lock, checks row presence in Postgres (filterMigrated), and serves the team from Postgres or Cassandra accordingly — the team is never read from a half-deleted Cassandra partition or a half-populated copy. Global email/code lookups consult both stores and dedupe.
• Residual windows are accepted and documented in the Wire.InvitationStore.DualWrite haddock (mirroring-insert failure after partition clear; presence-based routing for a team whose copy is still retrying), same as the connections migration accepted.
• Integration test updated (Test.Migration.Invitations): in the worker-on phase it now asserts the P1 team's Cassandra team_invitation partition is empty after migration and that the invitation is still served via the locked Postgres read-through.

No new config keys and no schema/bookkeeping-table change: lock acquisition itself is the progress barrier, same as #5685. History cleaned (mechanical fix commits folded, branch rebased onto current develop); make c for wire-subsystems/brig/background-worker, cabal build integration, test-suite builds and make hlint-check-pr all pass.