Cross-PR review 2026-06-11: P4 deleted the invite-lifecycle e2e (the only HTTP coverage for promote/leave); P5a replaced it with mocked unit + model-integration tests. NOTHING exercises POST /members, GET /members/search (its before-:memberId route-ordering claim), PUT /membership-requests/:id/accept (auth-only-no-CASL wiring), promote, or leave through real routes/passport/CASL/param middleware. Write organizations.memberAdd.e2e.tests.js: signup A (owner) + B → A searches B by email → addMember → B accepts → A promotes B → B leaves. (The invitations module's own e2e is the model to follow.)
Refs: #3812, #3813, epic #3808.
Cross-PR review 2026-06-11: P4 deleted the invite-lifecycle e2e (the only HTTP coverage for promote/leave); P5a replaced it with mocked unit + model-integration tests. NOTHING exercises
POST /members,GET /members/search(its before-:memberIdroute-ordering claim),PUT /membership-requests/:id/accept(auth-only-no-CASL wiring), promote, or leave through real routes/passport/CASL/param middleware. Writeorganizations.memberAdd.e2e.tests.js: signup A (owner) + B → A searches B by email → addMember → B accepts → A promotes B → B leaves. (The invitations module's own e2e is the model to follow.)Refs: #3812, #3813, epic #3808.