fix(webapp): hard-navigate after creating an organization

[claude]

Requested by Chris Arderne · Slack thread

Before / After

Before — submitting the new-organization form could drop you back on the creation form, with no error message anywhere and nothing to say the submit had succeeded, while the organization had in fact already been created. The natural next step was to click Create again — which created a second organization.

After — submitting the form completes and takes you to your new organization. If creating it genuinely fails, you get an error message on the form with what you typed still there.

How

Once the organization row is committed, the action redirects to the new organization, which redirects on again to its first page. That whole chain was being followed client-side: the router received the action's redirect, fetched the destination's loaders, followed the next redirect, and then had to load the destination route's code chunk before it could render anything.

That last step is where it broke. A capture of a real reproduction shows the navigation being aborted while the destination route's chunk was still loading. Remix's recovery for a chunk that fails to load is window.location.reload(), and because the router had not yet committed the new URL, the reload re-requested the URL still in the address bar — the creation form. The user landed back on the form with the organization already created, because the action had run to completion on the server. Clicking Create a second time then made a duplicate.

The two success redirects now use redirectDocument() instead of redirect(). That returns the same redirect response with an added reload-document marker, which the router acts on by handing the destination straight to the browser as a full document navigation. It does this before it starts the destination's loaders, so neither those loaders nor the destination route's code chunk are ever fetched client-side — the step the navigation was being lost on no longer happens.

The <Form> is unchanged from main. Remix still handles the submission itself, so the client-side zod validation and the pending/disabled state on the Create button behave exactly as before.

Deliberately not done: turning the submit itself into a native document POST via reloadDocument on the <Form>. An earlier revision of this PR did that, and it was removed. It takes the submission out of Remix's hands, and with it the pending navigation state that disables the Create button while the form is submitting — weakening the very double-click guard that stops the duplicate. It also re-initialises the page's React state on the error path, dropping the URL and company-size selections. Changing only the action's redirects leaves the submission, the validation and the disabled-button state exactly where they were, and hardens just the navigation after success.

The action's failure path is also tightened up: it returns a conform-shaped result and logs the underlying error, so a genuine failure is rendered with its message and the submitted values preserved instead of resetting silently.

---

Testing

Tested locally against a dev webapp, driving the real form in a browser:

• A normal submit creates the organization and lands on the post-creation page.
• The action's redirect response carries the reload-document marker, and the destination is then loaded as a document navigation (302 to the organization, then 200 on its first page), with no client-side loader or route-chunk request for it — this is the behaviour change that closes the window.
• Injecting the original failure — aborting the destination route's chunk mid-navigation — reproduces the old symptom before the change and no longer reproduces it after.
• The Create button still becomes disabled while the form is submitting, confirming the existing double-click guard is intact.
• Exactly one organization row is created per submit, confirmed by querying Postgres per submitted name before and after each submit.
• Client-side validation still gates the submit: an empty name and a too-short name both show the inline zod error, never reach the action, and create no organization.

Also ran pnpm run format, pnpm run lint:fix, and pnpm run typecheck --filter webapp — all clean.

---

Follow-ups

Not addressed here, to keep this change small:

• seedDefaultBillingAlerts is awaited inline after the organization row is committed, which adds latency to a request the user is waiting on. It cannot fail the request — it is wrapped in tryCatch and only logs — but it is still worth moving off the critical path. The inline await is deliberate, though: it stops the seed landing after the user's first alert edit, so any move off the request path has to preserve that ordering.
• The same client-side redirect chain exists on other creation forms, most notably project creation. Whether to harden those the same way is a separate call.

---

Changelog

Fixed the new-organization form so submitting it completes and takes you to your new organization, instead of sometimes landing you back on the creation form after the organization had already been created.

---

Screenshots

No visual changes — the form and the page it lands on are unchanged. The fix is in how the navigation after a successful submit is performed.

💯

[changeset-bot]

⚠️ No Changeset found

Latest commit: 52feba2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Observability map

As of 52feba2.

18/100 over 414 measured of 430 entry points (base 18, no change)

What this PR changed

route	base	head	now failing
/_app/orgs/new	0	50

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 12 of 414 entry points name a tenant on a failure path. 325 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  169 applicable,  94 pass,   0 sole, global without it 10
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 15
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 18
  request-context       414 applicable,  12 pass, 223 sole, global without it 63
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@708d4d0

trigger.dev

npm i https://pkg.pr.new/trigger.dev@708d4d0

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@708d4d0

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@708d4d0

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@708d4d0

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@708d4d0

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@708d4d0

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@708d4d0

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@708d4d0

commit: 708d4d0

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

Devin Review found 2 new potential issues.