- Shipped
- August 24, 2026 at 9:51 PM UTC
- Author
- kamo
- Commit
- 97cd4a0
Creating an org routed the creator to /setup/dns, and the reason was real: entering meant an OTK redirect to internal.<new-domain>, and a brand-new org has no DNS, so that host was unreachable. Configuring DNS was therefore the price of opening the thing you had just made -- the exact wall this work removes. The create call already returns a one-time key; the wizard just had nowhere to spend it. It now spends it on the current origin, where the session names the org, so there is no host to wait for. A domain is still worth having and Settings is where it lives now: an optional white-label step rather than a doorway. Branding warnings are carried through either way, and if no key comes back the org still exists, so the wizard lands on the estate view rather than failing. check-client-navigation correctly flagged the window.location.href. Its own docstring names /validate with a one-time key as a genuine session-boundary jump, so this is allowlisted with that reason rather than worked around -- the router would keep the creator's OLD session, which is precisely what is being replaced. 2857 tests and all 7 guards pass.