Right after install the dashboard SPA opens and, if it loads before NetBird's embedded OIDC provider is serving, caches a bad auth state — the user appears logged-in but can't log out until it self-corrects. Container "running" != OIDC ready, so gate the install's Done phase on the management server's /oauth2/.well-known/openid-configuration answering (best-effort, 60s cap, never fails the install since the stack is already up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>