- Shipped
- September 23, 2026 at 2:33 PM UTC
- Author
- Kamo
- Commit
- b043260
An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still shown a ninth step saying there was nothing to configure. It had to "save" that step before the wizard counted as finished (reported 2026-09-21). SecurityService now lists only the steps an organization is asked, and the page follows that list: the rail, the "x of y" count, where the wizard resumes, what comes after the last step, and a `?step=` naming a step that isn't listed. A payload with no usable list still reads as every step, so a malformed answer never leaves an empty wizard. complianceStepApplies.test.ts pins getComplianceStepUi to the same case table as SecurityService's OrgSetupStepApplicabilityTest. The server decides whether the step is listed, and this function decides what it draws, so the two must agree.