Step 3 asked nobody which company the building belonged to — so staff, and every dev laptop, were refused at the last step
10 Sept 2026 · branch w2b/wizard-org-picker · captured against propflow-stage · at 3bd2252c34
Data note. Every name and balance below comes from propflow-stage, which is anonymized by construction (ADR-0097/0110 — phones in the impossible +1000 NPA, emails @example.test). The identical capture against prod would carry real tenants' names and balances and is not safe to attach anywhere, which is why the generator refuses to run against one.
The wizard is driven end to end here: a synthetic two-unit rent roll is uploaded, both steps advanced, and step 3 photographed as a caller who may act for a company sees it. The Company field is the change. Before it, this same screen had no control for the organization, the Create button was enabled, and clicking it returned a 400 the page rendered verbatim — the final step was unreachable by any input.
Note the Create button is disabled with the hint reading Company required, even though name and address are both filled. That is the point: the wizard never offers a Create it already knows the route will refuse.
Asserted in the captured DOM — Company · Company required · Confirm Property Details. The picker's label, the blocking hint, and the step-3 heading — all present in the DOM in the state shown, not just in pixels.
The 403 half — an org-bounded customer, who must see no picker at all and post a byte-identical body — cannot be photographed on a dev server: requireAdmin returns null whenever NODE_ENV !== 'production', so the company probe answers 200 for everyone locally. That branch is covered by owning-company-picker.test.tsx, which drives the real FilterSelect and asserts both the absent picker and the absent third argument to onComplete.