fix(admin-console): first-time org creation silently bounced back to the picker

Live-tested the full desktop app (every route, every Settings/Runtime
Manager tab, headless Electron via e2e/full-app-tour.js) and the admin
console end to end through a real browser session with a throwaway fake
OIDC provider.

Desktop app: zero console/page errors across all 27 screens. Refreshed
docs/screenshots/ with the new captures and updated CLINICAL_WORKSPACE.md
to reflect the e2e coverage this pass actually exercised.

Admin console: found a real bug creating the very first organization.
POST /organizations succeeded, but navigating into it immediately raced
MeProvider's stale pre-creation membership snapshot, so RequireOrg bounced
back to the picker before the refreshed membership list ever landed,
indistinguishable from the creation having silently failed until a full
re-login. Fixed by making useMe()'s refresh() awaitable and having
OrgPicker await it before navigating. Verified live: no more bounce.

Documented both in docs/COMPUTE_CONTROL_PLANE.md alongside the earlier
CORS/Content-Type findings from the prior live-testing pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: voidstackloop

admin-console/src/lib/org-context.tsx

@@ -1,4 +1,4 @@
-import { createContext, useContext, useEffect, useState, type ReactNode } from "react";
+import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from "react";
 import { Navigate, useParams } from "react-router-dom";
 import { getMe } from "./api/client";
 import { loadPermissions, type PermissionMap } from "./authz/permissions";
@@ -7,7 +7,12 @@ import type { MeResponse } from "./api/types";
 interface MeContextValue {
     me: MeResponse | undefined;
     error: string | undefined;
-    refresh: () => void;
+    /** Awaitable so a caller that just mutated org membership (e.g.
+     * OrgPicker creating a new organization) can wait for the refreshed
+     * membership list before navigating into it — RequireOrg below bounces
+     * back to "/" the instant its organizationId isn't in `me.memberships`
+     * yet, which fired immediately on a fire-and-forget refresh. */
+    refresh: () => Promise<void>;
 }
 
 const MeContext = createContext<MeContextValue | undefined>(undefined);
@@ -19,27 +24,36 @@ const MeContext = createContext<MeContextValue | undefined>(undefined);
 export function MeProvider({ children }: { children: ReactNode }) {
     const [me, setMe] = useState<MeResponse | undefined>(undefined);
     const [error, setError] = useState<string | undefined>(undefined);
-    const [generation, setGeneration] = useState(0);
-
+    const mountedRef = useRef(true);
     useEffect(() => {
-        let cancelled = false;
+        // StrictMode's mount→cleanup→mount dance runs this cleanup once
+        // before the "real" mount — reset to true on every mount, not just
+        // once, or the ref stays permanently false and load() below never
+        // commits its result again.
+        mountedRef.current = true;
+        return () => {
+            mountedRef.current = false;
+        };
+    }, []);
+
+    const load = useCallback(async () => {
         // Intentional fetch-on-mount/refresh, same pattern (and same
         // suppression) as frontend/'s sessions-context.tsx.
         // eslint-disable-next-line react-hooks/set-state-in-effect
         setError(undefined);
-        getMe()
-            .then((response) => {
-                if (!cancelled) setMe(response);
-            })
-            .catch((err: unknown) => {
-                if (!cancelled) setError(err instanceof Error ? err.message : "Could not load your account.");
-            });
-        return () => {
-            cancelled = true;
-        };
-    }, [generation]);
+        try {
+            const response = await getMe();
+            if (mountedRef.current) setMe(response);
+        } catch (err) {
+            if (mountedRef.current) setError(err instanceof Error ? err.message : "Could not load your account.");
+        }
+    }, []);
+
+    useEffect(() => {
+        void load();
+    }, [load]);
 
-    return <MeContext.Provider value={{ me, error, refresh: () => setGeneration((g) => g + 1) }}>{children}</MeContext.Provider>;
+    return <MeContext.Provider value={{ me, error, refresh: load }}>{children}</MeContext.Provider>;
 }
 
 // eslint-disable-next-line react-refresh/only-export-components -- shared with MeProvider, same as sessions-context.tsx's useSessions

admin-console/src/pages/OrgPicker.tsx

@@ -44,6 +44,11 @@ export default function OrgPicker() {
         setCreateError(undefined);
         try {
             const { organization } = await createOrganization(newOrgName.trim());
+            // RequireOrg checks the freshly-created org against `me`'s
+            // membership list before rendering — without this, it's still
+            // the pre-creation snapshot and RequireOrg bounces straight back
+            // to "/", which looked like the creation had silently failed.
+            await refresh();
             navigate(`/organizations/${organization.id}/users`);
         } catch (err) {
             setCreateError(err instanceof ApiError ? (err.body?.message ?? err.message) : "Could not create the organization.");

docs/CLINICAL_WORKSPACE.md

@@ -602,7 +602,15 @@ Notably:
   tested in this codebase (see [Development: testing](DEVELOPMENT.md#testing)).
 
 Playwright e2e (`e2e/tests/*.spec.ts`) has not been extended for the clinical
-layer or run against it in this environment — see [Known limitations](#known-limitations).
+layer with scripted assertions, but `e2e/full-app-tour.js` (a headless,
+non-mocked Electron launch — the same `_electron.launch({headless: "new"})`
+pattern as `manual-app-test.js`) has been run against it end to end: every
+clinical route (Patient Cases list, create, detail; Evidence Library;
+Knowledge Graph; Audit & Privacy) plus every Settings and Runtime Manager tab,
+with zero console errors or uncaught page errors captured across the whole
+run. Screenshots from that pass are in `docs/screenshots/`. This is visual/
+crash verification, not scripted behavioral assertions — see [Known
+limitations](#known-limitations) for what that still leaves uncovered.
 
 ## Known limitations
 

docs/COMPUTE_CONTROL_PLANE.md

@@ -81,11 +81,12 @@ Verified directly against the desktop code rather than assumed, since "enforceme
 
 `admin-console/src/pages/ComputePolicies.tsx` covers signed resource policies: a full policy-version history per pool (every version, its status, and one-click activate — including activating a retired version, which is the rollback path), a draft composer for `hardLimits`/per-priority `workloadClassLimits` with a live effective-policy preview (the exact `{...hardLimits, ...workloadClassLimits[priority]}` merge the scheduler itself applies), a "download draft JSON" step, and a "paste the signed result and submit" step. Signing itself stays strictly offline — the Ed25519 private key never touches the browser or the server. `server/scripts/sign-compute-policy.js` is the tool that actually signs a draft (mirrors `app/scripts/sign-policy.js`'s pattern for the *different*, desktop-only central-policy system — verified end-to-end against the server's real `createComputePolicySignatureVerifier()` before shipping, including that a wrong organization id or a tampered payload both correctly fail verification).
 
-**Two real, previously-undetected bugs were found and fixed by actually running the server + admin console through a real browser session** (a throwaway fake OIDC provider, in-memory stores — see the roadmap memory for the harness) rather than only `app.inject()`-based integration tests, which bypass CORS entirely, and admin-console unit tests, which mock `fetch` directly:
+**Real, previously-undetected bugs were found and fixed by actually running the server + admin console through a real browser session** (a throwaway fake OIDC provider, in-memory stores — see the roadmap memory for the harness) rather than only `app.inject()`-based integration tests, which bypass CORS entirely, and admin-console unit tests, which mock `fetch` directly:
 1. `@fastify/cors`'s own default `methods` is `GET,HEAD,POST` only — every `PUT`/`PATCH`/`DELETE` call the admin console makes (quota saves, this page's policy activation, break-glass policy, user/group/policy/service-principal updates, deletes) was silently failing CORS preflight. Fixed in `app.ts` by passing an explicit methods list.
 2. `authorizedRequest()` unconditionally set `Content-Type: application/json` even on bodyless POST calls (policy activation, `createAccessReviewCampaign`, `verifyAiInferenceDeployment`) — Fastify correctly 400s an empty body declared as JSON. Fixed to only set the header when a body is actually present.
+3. **(Found on a later pass.)** `OrgPicker`'s "Create organization" silently appeared to fail: `POST /organizations` succeeded (201) and the org was really created, but the immediate `navigate()` into it raced `MeProvider`'s stale, pre-creation `me.memberships` snapshot — `RequireOrg` couldn't find the new org in that stale list and bounced straight back to the picker, which still read "you don't belong to any organization yet." The org was only reachable after a full re-login. Fixed by making `useMe()`'s `refresh()` awaitable (`org-context.tsx`) and having `handleCreateOrganization` await it before navigating — first-run org creation now lands directly on the new org's Users page. Verified live: created an org through the real browser session and confirmed no bounce.
 
-Both verified against the real fix, not just re-running the existing suite: a real quota save, and a real signed policy created via `server/scripts/sign-compute-policy.js` and activated, all through an actual browser session end to end.
+All verified against the real fix, not just re-running the existing suite: a real quota save, a real signed policy created via `server/scripts/sign-compute-policy.js` and activated, and a real first-time "create organization" flow, all through an actual browser session end to end.
 
 **Compute audit events use the general Audit page, not a dedicated view** — deliberately not duplicated, since `listAudit`'s `action`/`targetType` filters are exact-match only (no prefix/wildcard support server-side), so a single "show all compute events" link isn't possible without a broader audit-search change this pass didn't make. Filter by `targetType` to browse a specific compute entity's history: `computeNode`, `computePool`, `computeRequest`, `computeLease`, `computePolicy`. Real action strings recorded: `computeNode.stateChanged`, `computePool.created`, `computeQuota.updated`, `computePolicy.created`, `computePolicy.activated`, `computeRequest.submitted`, `computeRequest.cancelled`, `computeLease.allocated`, `computeLease.acknowledged`, `computeLease.released`.