🎯 Invitations/org hardening — post-epic follow-ups (tracker)

[PierreBrisorgueil]

Parent tracker for the follow-up issues filed during the invitations↔org decouple epic (#3808, P1-P8 shipped 2026-06-10→12) — cross-PR review findings, user-feedback extras, and the referral phase-2 items. The epic itself stays separate (only P9 prod tag pending).

Referral (phase 2):

• 🔒 GATE for referral phase (#5): /api/invitations must be invitedBy-scoped for non-admins (+ self-referral guard, open-signup note) #3833 — 🔒 GATE: /mine scoping + self-referral guard + open-signup decision (REQUIRED before widening invite ability to users)
• ✨ instant referee grant: retry grantForInvitation when the org is provisioned at email verification #3844 — ✨ instant referee grant at email verification (org-provisioned event retry)

Org membership lifecycle:

• ✨ owner_add lifecycle: invitee decline, owner cancel, pending visibility, last-owner scope, user-delete cleanup #3831 — ✨ owner_add lifecycle (invitee decline, owner cancel, pending visibility, last-owner scope, user-delete cleanup)
• ✨ addMember should notify the invitee (email) + surface pending owner_adds on the org-required wall #3832 — ✨ invitee signal (addMember email + org-required wall surface + cap error message)
• 🔧 restore HTTP-level e2e for the org membership lifecycle (addMember→accept→promote→leave) #3835 — 🔧 membership HTTP e2e (addMember→accept→promote→leave)
• 🐛 membership partial-unique index (userId,organizationId) declared in the model but absent on deployed DBs #3841 — 🐛 membership partial-unique index absent on deployed DBs

Invitation ops:

• 🔧 invitation ops: copy-link/resend, revoke status-guard, duplicate-pending guard #3834 — 🔧 copy-link/resend, revoke status-guard, duplicate-pending guard

Security:

• 🔒 PUT /api/users email change doesn't reset emailVerified → OAuth account-annexation risk #3825 — 🔒 email change doesn't reset emailVerified (OAuth annexation risk)

Admin/UX (Vue):

• 🐛 deactivated invitations module still bakes its tabs into the generated config (404 tab clicks downstream) Vue#4295 — 🐛 deactivated module still bakes tabs into generated config
• 🔧 admin Activity tab: use the stack datatable search + actions top-right of the card Vue#4296 — 🔧 admin Activity tab search/actions
• 🔧 admin home: drop the 'No mailer configured' banner (readiness already covers it — precise the wording) Vue#4297 — 🔧 drop redundant mailer banner (readiness precise)

Misc:

• ✨ readiness summary count surfaced for the admin Readiness tab badge (analysis) #3836 — ✨ readiness summary badge (analysis)

Sub-issues attached natively — the board's no:parent-issue view shows this tracker only; the Sub-issues progress bar tracks completion.

[PierreBrisorgueil]

✅ All 13 sub-issues shipped & merged (5 waves, 12 PRs squash-merged):

• Security: 🔒 PUT /api/users email change doesn't reset emailVerified → OAuth account-annexation risk #3825 (emailVerified reset), 🔒 GATE for referral phase (#5): /api/invitations must be invitedBy-scoped for non-admins (+ self-referral guard, open-signup note) #3833 (invitation list scoping + self-invite guard + open-signup gate)
• Integrity: 🐛 membership partial-unique index (userId,organizationId) declared in the model but absent on deployed DBs #3841 (membership user_org_unique partial-index root-cause — the $ne spec never built; schema + boot migration), 🔧 invitation ops: copy-link/resend, revoke status-guard, duplicate-pending guard #3834 (invitation ops: revoke status-guard, duplicate-pending guard, resend endpoint)
• owner_add lifecycle (cross-stack): ✨ owner_add lifecycle: invitee decline, owner cancel, pending visibility, last-owner scope, user-delete cleanup #3831 (decline endpoint, last-owner scope, pending visibility, user-delete cleanup), ✨ addMember should notify the invitee (email) + surface pending owner_adds on the org-required wall #3832 (addMember invitee email + signup cap-error detail) — Node feat(organizations): owner_add lifecycle + addMember invitee email #3858 + Vue #4307
• Referral + coverage: ✨ instant referee grant: retry grantForInvitation when the org is provisioned at email verification #3844 (instant referee grant on organization.provisioned), 🔧 restore HTTP-level e2e for the org membership lifecycle (addMember→accept→promote→leave) #3835 (membership lifecycle HTTP e2e)
• Admin/UX: ✨ readiness summary count surfaced for the admin Readiness tab badge (analysis) #3836 (readiness tab badge), #4295 (activation-aware tabs), #4296 (admin Activity search), #4297 (drop mailer banner + precise readiness wording) — Vue #4308 + Node fix(home): precise readiness mail-warning wording (#4297 Node half) #3861
• Bug: #4305 (failed-login no longer shows a "success: Signed out" toast) — Vue #4309

PRs: Node #3854 #3855 #3856 #3857 #3858 #3859 #3860 #3861 · Vue #4306 #4307 #4308 #4309. Each: TDD implement → spec+quality review → DeepSeek pre-push gate → CodeRabbit/Copilot/critical-review convergence → CI green.

Follow-ups (separate, tracked): the full-repo public-OSS downstream-ref scrub (#3847 / Vue#4303) — 3 leaks neutralized in-passing this batch, README.md:50 still pending a complete git grep. Downstream propagation to consumers via /update-stack.