diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
index e65883463..3b5f19d85 100644
--- a/docs/product-technical-gap-baseline.md
+++ b/docs/product-technical-gap-baseline.md
@@ -21,6 +21,6 @@
 - **Zotero Integration**: Papers and standards referenced by TEPP must be synced via Local Zotero API (http://localhost:23119/api/) and cited using APA 7th edition in docstrings.
 - **Testing**: We need actual testing of Psychometrics (Fast-MLSIRM parameter calibration, RMSE of estimates, Fixed-Item Parameter Calibration, CAT) against synthetic/demo data.
 - **Security & Compliance**: PII masking cannot break the system. Need SOC 2 and CSAP compliance alternatives to blind PII masking. 
-- **LLM Orchestration**: Ensure ALL LLM calls route through `contextual-orchestrator` utilizing API keys (BYTEZ, NVIDIA, OPENROUTER, OPENAI) with auto model discovery and optimal reasoning effort allocation (Fugu/Conductor/TRINITY research).
+- **LLM Orchestration**: Partially resolved -- every one of `backend/app/main.py`'s 13 orchestrator client factories (`_keyman_extraction_client`, `_entity_relationship_client`, `_organization_name_resolution_client`, `_customer_hint_resolution_client`, `_corporate_hierarchy_inference_client`, `_post_summary_client`, `_adjudication_client`, `_post_structure_client`, `_post_chat_client`, `_commitment_extraction_client`, `_vision_client`, `_embedding_client`, `_post_evaluation_client`) routes through `settings.orchestrator_base_url`/`orchestrator_api_key` -- confirmed no hardcoded provider SDK, key, or endpoint (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `BYTEZ_API_KEY`, `NVIDIA_NIM_API_KEY`, `OPENROUTER_API_KEY`) appears anywhere in `lineageweave/`, `backend/`, or `scripts/`. Generative and VISION requests send `"mode": "auto"` plus a `reasoning_effort` value, delegating model selection and reasoning-depth allocation per call; the embedding client uses the orchestrator's dedicated embedding contract and correctly has no reasoning-depth field. Still open: exact-head upstream evidence that `contextual-orchestrator` discovers all configured provider credentials and applies its Fugu/Conductor/TRINITY policy. That evidence must be fixed in the upstream repository when absent; LineageWeave client routing alone does not prove it.
 
 *This document is continuously updated by the hourly automated agent loop.*
diff --git a/frontend/src/App.test.tsx b/frontend/src/App.test.tsx
index 7462abd2c..9582ae69e 100644
--- a/frontend/src/App.test.tsx
+++ b/frontend/src/App.test.tsx
@@ -28,19 +28,25 @@ beforeEach(() => {
 
 afterEach(() => {
   vi.unstubAllGlobals();
+  window.sessionStorage.clear();
+  window.localStorage.clear();
 });
 
 describe("App, unauthenticated", () => {
   it("shows a login button that starts the real OIDC redirect", async () => {
+    window.history.replaceState({}, "", "/?post=abc#details");
     render(<App showLabPanels />);
     const button = screen.getByRole("button", { name: /log in/i });
     await userEvent.click(button);
     expect(signinRedirect).toHaveBeenCalledTimes(1);
     expect(signinRedirect).toHaveBeenCalledWith(
       expect.objectContaining({
-        state: expect.objectContaining({ returnUrl: expect.stringMatching(/^\//) }),
+        state: expect.objectContaining({ returnUrl: "/?post=abc#details" }),
       }),
     );
+    // Persisted as a fallback in case the OIDC state round-trip is dropped
+    // (see oidcReturnUrl.ts's restoreOidcReturnUrl, consumed in main.tsx).
+    expect(window.sessionStorage.getItem("lineageweave.oidc.returnUrl")).toBe("/?post=abc#details");
   });
 });
 
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 6fba0dd41..1b5b351ab 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -4610,7 +4610,8 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
             </div>
             <div className="login-controls">
               <button className="btn-primary" onClick={() => {
-                const returnUrl = window.location.pathname + window.location.search;
+                const returnUrl = returnUrlFromLocation();
+                rememberOidcReturnUrl(returnUrl);
                 void auth.signinRedirect({ state: { returnUrl } });
               }}>
                 {t("Log in")}
@@ -4620,7 +4621,6 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
               <small>Enterprise SSO Authentication</small>
             </div>
           </div>
-          {destination === "admin" ? <AdminPanel currentBrandName={brandName} onBrandNameChange={setBrandName} accessToken={accessToken} /> : null}
       </main>
         <footer className="app-footer" role="contentinfo">
           <div className="app-footer-title">