🎯 Invitations/org hardening — post-epic follow-ups (tracker)

[PierreBrisorgueil]

Parent tracker for the follow-up issues filed during the invitations↔org decouple epic (#3808, P1-P8 shipped 2026-06-10→12) — cross-PR review findings, user-feedback extras, and the referral phase-2 items. The epic itself stays separate (only P9 prod tag pending).

Referral (phase 2):

• 🔒 GATE for referral phase (#5): /api/invitations must be invitedBy-scoped for non-admins (+ self-referral guard, open-signup note) #3833 — 🔒 GATE: /mine scoping + self-referral guard + open-signup decision (REQUIRED before widening invite ability to users)
• ✨ instant referee grant: retry grantForInvitation when the org is provisioned at email verification #3844 — ✨ instant referee grant at email verification (org-provisioned event retry)

Org membership lifecycle:

• ✨ owner_add lifecycle: invitee decline, owner cancel, pending visibility, last-owner scope, user-delete cleanup #3831 — ✨ owner_add lifecycle (invitee decline, owner cancel, pending visibility, last-owner scope, user-delete cleanup)
• ✨ addMember should notify the invitee (email) + surface pending owner_adds on the org-required wall #3832 — ✨ invitee signal (addMember email + org-required wall surface + cap error message)
• 🔧 restore HTTP-level e2e for the org membership lifecycle (addMember→accept→promote→leave) #3835 — 🔧 membership HTTP e2e (addMember→accept→promote→leave)
• 🐛 membership partial-unique index (userId,organizationId) declared in the model but absent on deployed DBs #3841 — 🐛 membership partial-unique index absent on deployed DBs

Invitation ops:

• 🔧 invitation ops: copy-link/resend, revoke status-guard, duplicate-pending guard #3834 — 🔧 copy-link/resend, revoke status-guard, duplicate-pending guard

Security:

• 🔒 PUT /api/users email change doesn't reset emailVerified → OAuth account-annexation risk #3825 — 🔒 email change doesn't reset emailVerified (OAuth annexation risk)

Admin/UX (Vue):

• 🐛 deactivated invitations module still bakes its tabs into the generated config (404 tab clicks downstream) Vue#4295 — 🐛 deactivated module still bakes tabs into generated config
• 🔧 admin Activity tab: use the stack datatable search + actions top-right of the card Vue#4296 — 🔧 admin Activity tab search/actions
• 🔧 admin home: drop the 'No mailer configured' banner (readiness already covers it — precise the wording) Vue#4297 — 🔧 drop redundant mailer banner (readiness precise)

Misc:

• ✨ readiness summary count surfaced for the admin Readiness tab badge (analysis) #3836 — ✨ readiness summary badge (analysis)

Sub-issues attached natively — the board's no:parent-issue view shows this tracker only; the Sub-issues progress bar tracks completion.