diff --git a/.changeset/clean-exit-on-expired-signin.md b/.changeset/clean-exit-on-expired-signin.md
new file mode 100644
index 00000000..14ee4ae7
--- /dev/null
+++ b/.changeset/clean-exit-on-expired-signin.md
@@ -0,0 +1,9 @@
+---
+'ePDS': minor
+---
+
+Sign-in pages no longer strand users on a "session expired" dead end, and Resend no longer offers codes that won't work.
+
+**Affects:** End users
+
+**End users:** if your sign-in times out (you closed the tab and came back, or your wait was longer than the page can keep alive in the background), you are now taken back to the app you were signing in to so it can offer you a retry. The page also no longer offers Resend in the rare case where the new code wouldn't work — instead it tells you the sign-in has timed out and gives you a Start over button. No more typing a fresh code that fails. If for some reason the automatic return is not possible, the page shows a "Return to sign in" button so you can get back to the app yourself in one click.
diff --git a/.changeset/par-heartbeat-keeps-slow-signins-alive.md b/.changeset/par-heartbeat-keeps-slow-signins-alive.md
new file mode 100644
index 00000000..98de12d3
--- /dev/null
+++ b/.changeset/par-heartbeat-keeps-slow-signins-alive.md
@@ -0,0 +1,9 @@
+---
+'ePDS': minor
+---
+
+Slow sign-ins are less likely to time out before you finish entering your code.
+
+**Affects:** End users
+
+**End users:** if you take a few minutes to find your sign-in code in your inbox before entering it, you will no longer be bounced to a "session expired" page when you submit it. Closing the tab or walking away for a long stretch can still expire the flow, in which case the existing error pages still apply — but reading email at human speed should not.
diff --git a/docs/design/par-expiry-and-clean-exits.md b/docs/design/par-expiry-and-clean-exits.md
new file mode 100644
index 00000000..bd4adf1a
--- /dev/null
+++ b/docs/design/par-expiry-and-clean-exits.md
@@ -0,0 +1,460 @@
+# PAR Expiry, Heartbeats, and Clean Exits
+
+Working design doc for the OTP / PAR / auth_flow timer interactions and the
+"stuck in a loop" failure modes a slow user can trip during OAuth login.
+
+This is a living document — keep it current as scope, decisions, or
+findings change.
+
+## Problem
+
+A real user reported being stuck in a login loop:
+
+1. They start an OAuth login (flow=email-first, `prompt=login`).
+2. They receive the OTP email but wait >10 minutes before entering it.
+3. The OTP-expired UI fires as expected.
+4. They click "Resend" and receive a fresh OTP.
+5. They enter the second OTP and see "Your sign-in took too long to
+   complete and timed out. Please start sign-in again."
+6. There is no working path forward — the page is a dead end.
+
+We had landed several recent OTP-expiry fixes (PRs leading up to
+`dacf1d2`, `0e62bd6`, etc.) and added e2e scenarios specifically for OTP
+expiry, so the immediate question was: how did this slip through?
+
+## The three timers
+
+| Timer                   | Default        | Where                                                |
+| ----------------------- | -------------- | ---------------------------------------------------- |
+| OTP TTL                 | 10 min         | better-auth `verification` row (auth-service SQLite) |
+| PAR (`request_uri`) TTL | 5 min, sliding | `@atproto/oauth-provider` request store (pds-core)   |
+| auth_flow TTL           | 60 min         | auth-service SQLite + `epds_auth_flow` cookie        |
+
+Each lives in a different layer because each layer owns a different
+concept (better-auth: email-OTP only; oauth-provider: OAuth handshake
+only; auth-service: glue ePDS adds to bridge them).
+
+### What each one gates
+
+- **OTP TTL** — the 8-char code in the email. Fixed at row creation.
+  Resend creates a new row.
+- **PAR TTL** — the `request_uri` handle that points to all the OAuth
+  parameters (client_id, scope, code_challenge, redirect_uri, state)
+  the client pushed at flow start. Without it the OAuth flow has no
+  memory of the original request. **Sliding**: every successful
+  `requestManager.get()` resets `expiresAt` to `now + 5 min`. There is
+  no absolute ceiling — pinged often enough, the row lives indefinitely.
+  When the timer fires, the row is deleted in the same call that
+  throws.
+- **auth_flow TTL** — auth-service's bridge that remembers which OAuth
+  flow a user is in across page navigations. Without it, `/auth/complete`
+  doesn't know which `request_uri` to redirect back to.
+
+### How the bug fires
+
+User sits on the OTP form for 6 minutes. During those 6 minutes:
+
+- OTP (10 min) — alive.
+- PAR (5 min sliding) — **dead at minute 5**, because nothing on the
+  OTP form calls `requestManager.get()` while the user reads.
+- auth_flow (60 min) — alive.
+
+User submits OTP. Auth-service verifies it (OTP alive, auth_flow alive
+— looks fine). It then bridges back to the OAuth flow via PAR → dead →
+user lands on whichever error page is downstream of the failing `get()`
+with no recovery path.
+
+## Why the existing scenarios missed it
+
+| Scenario                         | OTP expired | PAR expired | auth_flow expired | Resend in flow |
+| -------------------------------- | ----------- | ----------- | ----------------- | -------------- |
+| `@otp-expiry` (existing)         | Yes         | **No**      | No                | Yes            |
+| `@par-callback-error` (existing) | No          | Yes         | No                | No             |
+| `@otp-and-par-expiry` (new)      | Yes         | Yes         | No                | Yes            |
+| `@multiple-resend` (new)         | No          | Yes         | No                | Yes (twice)    |
+| `@prompt-login` (new)            | No          | Yes         | No                | No             |
+| `@recovery` (new)                | No          | Yes         | No                | No             |
+
+`@otp-expiry` only ages the OTP row and _deliberately keeps the PAR
+alive_ to isolate the auth-service-side TTL fix from the PDS layer.
+But PAR's hardcoded 5-min TTL is shorter than OTP's 10-min TTL, so in
+production the PAR is already dead by the time OTP expiry ever fires.
+The scenario passes because it artificially preserves a row that
+wouldn't exist in real life.
+
+`@par-callback-error` only covers the _response shape_ when PAR is
+dead at callback (styled HTML vs raw JSON). It does not exercise
+Resend at all and asserts nothing about user recovery.
+
+The four new scenarios cover four real-user paths that were untested.
+
+### Surfaces the bug presents on
+
+The same root cause (PAR dead before final bridge) presents three
+different error pages depending on which downstream call hits PAR
+first:
+
+- auth-service `/auth/choose-handle`: "Session expired, please start
+  over" (basic + multiple-Resend scenarios)
+- pds-core friendly redirect from `/oauth/epds-callback`'s catch
+  block: "Your sign-in took too long to complete and timed out…"
+  (recovery scenario)
+- Browser stalls navigating to `/oauth/epds-callback` and never
+  reaches `/welcome` (prompt=login scenario)
+
+Each of these is a dead end for the user today.
+
+## Strategy
+
+Two layers, in priority order:
+
+### 1. Clean exit — the contract
+
+**Every error a slow user can trip must end with a working path back
+to the OAuth client.** No stranded pages, no loops. This is the
+non-negotiable outcome.
+
+Audit every page that today says "Session expired" / "Authentication
+failed" / "Your sign-in took too long" / similar, and confirm each
+one offers either:
+
+- an automatic redirect to the OAuth client's `redirect_uri` with an
+  OAuth-spec error (`error=access_denied`, `error_description=…`,
+  `state`, `iss`) so the client can show its own retry UI; or
+- a "Start over" button that re-initiates the OAuth flow from scratch.
+
+The four RED scenarios surface three different dead-end pages already
+— that is the starting list for the audit.
+
+### 2. Heartbeat — the UX polish
+
+Keep the PAR alive while the user is genuinely on the page so the
+common case (slow inbox / slow typist) doesn't hit the dead end at
+all. PAR has a built-in refresh primitive (`pingParRequest`) which is
+already wired into a few server-side handoff points but not from the
+pages where humans actually wait.
+
+Apply heartbeats only where it materially helps and doesn't weaken
+security:
+
+- OTP form (login) — main case
+- Recovery form — same shape
+- Skip handle picker (already has server-side ping at render time)
+- Skip email-input form (user is fast, PAR is fresh)
+
+Heartbeats are **opportunistic**. If they fail, security is unchanged
+and the user falls through to the clean-exit path from layer 1.
+Timeouts will happen regardless of heartbeats.
+
+### Security guardrails for heartbeats
+
+The heartbeat must not be a way to extend more than it should:
+
+- Only refreshes PAR (timer 2). Doesn't touch OTP or auth_flow TTLs.
+- Tied to a valid `epds_auth_flow` cookie — no flow → no ping.
+- Bounded by auth_flow's 60-min ceiling — once auth_flow dies, the
+  ping has nothing to look up and becomes a no-op. PAR cannot be kept
+  alive past 60 min via heartbeat.
+- Rate-limited per flow.
+- Read-only on auth-service; only effect is sliding upstream's timer
+  via an already-internal call.
+- Not credential-bearing.
+
+### What the strategy explicitly does NOT do
+
+- Does not bump any of the three TTL defaults.
+- Does not regenerate a fresh PAR mid-flow (PAR carries client-supplied
+  params auth-service can't recreate without round-tripping to the
+  OAuth client).
+- Does not extend OTP or auth_flow TTLs.
+
+## Tracked work
+
+### RED scenarios (committed, currently failing)
+
+In `features/passwordless-authentication.feature`, all tagged
+`@otp-and-par-expiry`:
+
+- `Expired OTP + expired PAR — Resend must still recover the flow`
+- `Two Resend cycles after silent PAR death still complete the flow`
+  (`@multiple-resend`)
+- `prompt=login + expired PAR — flow must still complete`
+  (`@prompt-login`)
+- `Recovery via backup email + expired PAR — flow must still complete`
+  (`@recovery`)
+
+All four reproduce on `origin/main` (commit `ffc17bd`). All four are
+preserved as worst-case "PAR is hard-dead" coverage even after the
+heartbeat lands — they go GREEN only when clean-exit makes the dead
+end usable.
+
+### Dead-end pages → target UX
+
+Each row is a `renderError(...)` call site that a slow user can reach
+on the auth path. "Page" is the route showing the error. "Trigger" is
+which TTL/state condition caused it. "Today" describes the current
+DOM/redirect outcome — every entry that says "static page" is a dead
+end (the shared `renderError` template has no retry link, no Start
+Over button — see `packages/shared/src/render-error.ts`). "Target" is
+the proposed clean-exit UX.
+
+> **Note (post-resolution):** the table records the audit at decision
+> time. Some Target cells speculate about a `/_internal/par-…`-style
+> lookup or bare `/oauth/authorize` restart. The resolved approach
+> (see "Resolved decisions" below) replaced both with a single shape:
+> resolve the OAuth client's published metadata via
+> `@certified-app/shared`'s `resolveClientMetadata()` to recover
+> `redirect_uris[0]`, then issue the spec error redirect. No new
+> pds-core internal endpoints; no bare authorize restart. The table
+> is preserved as-written to keep the audit honest about the option
+> space; the "Resolved decisions" section is the source of truth for
+> what shipped.
+
+| #   | Page                                                 | Trigger                                                                                                 | Today                                                                                                                                                                                                                                                     | Target                                                                                                                                                                             |
+| --- | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1   | `/auth/complete` (no cookie)                         | `epds_auth_flow` cookie missing                                                                         | Static "Authentication session expired. Please try again."                                                                                                                                                                                                | Redirect back to OAuth client with `error=access_denied` if `redirect_uri` recoverable; else static page with Start Over link to fresh `/oauth/authorize` for the original client. |
+| 2   | `/auth/complete` (no flow row)                       | auth_flow row missing/expired                                                                           | Static "Authentication session expired. Please try again."                                                                                                                                                                                                | Same as #1. The flow row carried `requestUri` + `clientId`; if it's gone we don't know `redirect_uri` and must fall back to Start Over.                                            |
+| 3   | `/auth/complete` (better-auth session error)         | better-auth session lookup throws                                                                       | Static "Authentication failed. Please try again."                                                                                                                                                                                                         | Redirect to client with `error=server_error` if recoverable; otherwise Start Over.                                                                                                 |
+| 4   | `/auth/choose-handle` (no cookie / no flow)          | same as #1/#2 but on handle picker                                                                      | Static "Session expired, please start over"                                                                                                                                                                                                               | Same as #1.                                                                                                                                                                        |
+| 5   | `/auth/choose-handle` (better-auth session error)    | session lookup throws                                                                                   | Static "Authentication failed. Please try again."                                                                                                                                                                                                         | Same as #3.                                                                                                                                                                        |
+| 6   | `/auth/choose-handle` (no session user)              | better-auth session has no user                                                                         | Static "Session expired, please start over"                                                                                                                                                                                                               | Same as #1.                                                                                                                                                                        |
+| 7   | `/auth/choose-handle` (PAR ping fails on render)     | upstream PAR row dead before user even sees the picker                                                  | Static "Session expired, please start over"                                                                                                                                                                                                               | Redirect to client (we still hold `flow.clientId` here, can resolve `redirect_uri` via `/_internal/par-…`-style lookup OR we can defer — see open question below).                 |
+| 8   | `/auth/choose-handle` (PAR ping fails on POST)       | PAR died while user was picking                                                                         | Static "Session expired, please start over"                                                                                                                                                                                                               | Same as #7.                                                                                                                                                                        |
+| 9   | `/oauth/epds-callback` catch (PAR-expired branch)    | upstream `requestManager.get()` threw `expired`/`unknown request_uri`                                   | Already does the right thing IF `redirect_uri` was captured before the throw: redirects to client with `error=access_denied` + description. Falls back to a styled-but-static "Your sign-in took too long…" page when `redirect_uri` was not recoverable. | Keep redirect path. For the static-fallback case, add a Start Over link/button so the user can re-initiate.                                                                        |
+| 10  | `/oauth/epds-callback` catch (server_error branch)   | any other throw                                                                                         | Static "Authentication failed."                                                                                                                                                                                                                           | Same shape: redirect when possible, Start Over fallback when not.                                                                                                                  |
+| 11  | `/auth/recover` (missing request_uri)                | direct GET without query param                                                                          | Static "Missing request_uri parameter"                                                                                                                                                                                                                    | Out of scope — this isn't an expiry case, it's misuse. Leave as is.                                                                                                                |
+| 12  | Recovery OTP verify success → `/auth/complete` chain | recovery flow hands back to `/auth/complete`; if PAR died during the recovery loop, falls into #1/#2/#9 | Inherits the surface of whichever route fires                                                                                                                                                                                                             | Inherits the fix.                                                                                                                                                                  |
+
+### Failure clusters
+
+The table collapses into three clusters:
+
+- **A: redirect-when-possible** (#1, #2, #3, #4, #5, #6, #9, #10) —
+  user reaches an error after a sign-in attempt; redirect them back
+  to the OAuth client with the OAuth-spec error so the client's own
+  UI handles retry. This is what the OAuth spec says to do anyway.
+
+- **B: PAR-dead-on-handle-page** (#7, #8) — discovered before the
+  callback hop. Fix is to feed the same redirect-when-possible logic
+  with the `redirect_uri` we can pull from the (still-alive) auth_flow
+  row before it's too late.
+
+- **C: nothing recoverable** — when we have neither a live auth_flow
+  nor a captured `redirect_uri`, the user must Start Over. Static
+  pages that hit this case need a Start Over link/button. Today they
+  are silent dead ends.
+
+### Building blocks we already have
+
+- `handleCallbackError()` in `packages/pds-core/src/lib/epds-callback-error.ts`
+  already does the redirect-when-possible logic for `/oauth/epds-callback`.
+  Lift it (or its shape) into a shared helper auth-service can call.
+- `flow.clientId` is on every auth_flow row, so given a live flow we
+  can always find the OAuth client's metadata (`redirect_uris`, etc.)
+  to construct a redirect target.
+- `renderError()` is the shared template; extending it to optionally
+  render a Start Over button (with a `clientId` or fully-qualified
+  authorize URL) is a one-place change.
+
+### Resolved decisions
+
+Guiding principle: **minimum friction for the end user** — fewest
+steps to retry, no manual restart when an automatic bounce-back is
+possible.
+
+1. **Start Over destination = the OAuth client.** Always redirect to
+   the client's registered `redirect_uri` with the OAuth-spec error
+   query params. The client's own UI handles "try again", which is
+   one click on familiar branding. This is also what RFC 6749 §4.1.2.1
+   prescribes. We cannot synthesise a valid `/oauth/authorize` URL
+   without the dead PAR's `state`/`code_challenge`/etc., so a "bare
+   re-authorize" path isn't actually feasible. The Start Over page is
+   only the last-resort fallback when no clientId is in scope at all.
+
+2. **Cluster B (PAR-dead-on-handle-page) → redirect to the client.**
+   We have `flow.clientId` on every auth*flow row and OAuth clients
+   publish metadata independently of the PAR row, so
+   `redirect_uris[0]` is resolvable. The original `state` is lost
+   (it lived in the PAR). RFC 6749 §4.1.2.1 explicitly \_requires*
+   `state` in the error response when it was present in the
+   authorization request, so this is a pragmatic degradation — not
+   a spec-permitted shortcut. We chose redirect-without-state over
+   stranding the user because every spec-compliant OAuth client
+   already has to handle the case where it cannot correlate an
+   error response with an in-flight attempt (e.g. cross-device
+   resumption, browser session loss), so an "anonymous error,
+   restart" outcome is universally recoverable on the client side
+   even if it is not the spec's preferred shape.
+
+3. **Recovery flows must carry `clientId`.** The current `clientId:
+null` on recovery's auth_flow row is a side-effect of the DB API,
+   not a design choice. Thread the clientId from the login page into
+   the recovery link (URL or cookie) so the recovery page can
+   populate it on the auth_flow row at creation. This puts recovery
+   flows on the same redirect-to-client path as everything else, no
+   manual restart.
+
+The shape of the implementation falls out of these:
+
+- One shared helper `redirectToClientWithError(res, clientId, code,
+description, state?)` that resolves client metadata and issues the
+  RFC 6749 error redirect. Called from every cluster A and B site.
+- Lift `handleCallbackError`'s redirect logic into that helper so
+  pds-core and auth-service share one code path.
+- `renderError` gains an optional Start Over href, used only by the
+  cluster C fallback when no clientId is in scope.
+
+### White-boxing budget
+
+This work must avoid adding to the white-boxing surface catalogued in
+`docs/design/pds-white-boxing.md`. Concretely:
+
+- **Auth-service resolves client metadata itself.**
+  `@certified-app/shared` already exposes `resolveClientMetadata(clientId)`
+  which fetches the public client metadata document directly. This
+  means cluster A/B redirects can be built in auth-service without
+  any new pds-core internal endpoint and without any new
+  `provider.<thing>` access. Zero new white-boxing.
+- **Cluster A/B implementation lives entirely in auth-service.** The
+  shared helper above is an `auth-service` lib (or a `shared`
+  utility), not a pds-core route. Pds-core continues to have its own
+  `handleCallbackError` for cluster A on `/oauth/epds-callback`
+  because that path is already inside pds-core; the helper shape can
+  be aligned across both services without forcing them to share a
+  module.
+- **Heartbeat reuses existing pds-core `/_internal/ping-request`.**
+  No new pds-core endpoint. Auth-service adds a new public
+  `/auth/ping` route that calls the existing internal one
+  server-side; the public route is an auth-service-only concern.
+- **No new `requestManager` calls.** Nothing in this work needs to
+  read the dead PAR row. We use only the OAuth client metadata
+  (which is auth-service-resolvable) and `flow.clientId` (which
+  auth-service already stores).
+- **Recovery flow's clientId** is threaded through query-string /
+  cookie at link-render time, not by exposing expired PAR rows from
+  pds-core. The login page already has the clientId in scope.
+
+### Future open questions (defer)
+
+- Heartbeat interval (3 min vs shorter) — pick during impl.
+- `?no-heartbeat=1` test toggle — useful regression-testing primitive
+  but tied to heartbeat rollout, not clean-exit.
+
+## Decisions log
+
+- **Clean exit > heartbeat in priority.** Heartbeats are polish;
+  reliable recovery from dead ends is the contract.
+- **Heartbeats only where reasonable.** OTP form + recovery form for
+  now; not handle picker, not email-input form.
+- **Don't change TTLs.** They are correct for what each layer owns.
+
+## Out of scope (for now)
+
+- Changes to upstream `@atproto/oauth-provider` constants.
+- Re-architecting the auth_flow / PAR / OTP separation.
+- Generic session-keepalive that crosses concerns.
+
+## Bug found post-PR-154: Resend offers a code that cannot complete the flow
+
+**What broke:** the user lands on the OTP form after the OTP has expired
+(>10 min), clicks Resend, gets a fresh code, types it in — and is
+bounced back to the OAuth client with an `error=access_denied` redirect.
+The clean-exit contract is technically satisfied (user is recoverable,
+not stranded inside ePDS), but the experience is a lie: we offered them
+Resend as if it would complete the flow, accepted their fresh OTP, then
+told them sign-in failed.
+
+**Why it happens:** the heartbeat keeps the upstream PAR alive only
+while the page is actively pinging. A user who waits >10 min for the
+OTP has typically also let the PAR die at minute 5 (browser tab
+backgrounded, laptop closed, network hiccup hit two pings in a row,
+etc.). When they click Resend, better-auth happily issues a new OTP
+because it doesn't know about the PAR. Auth-service then signs the
+callback against the dead `request_uri` and pds-core's
+`handleCallbackError` redirects the user back to the OAuth client
+with `error=access_denied`.
+
+**Resolved approach:** prevent the dishonest cycle in the first place.
+
+- **Proactive notice (no redirect).** When the heartbeat's
+  `/auth/ping` returns `par_expired`, the OTP form replaces its
+  current state with a clear notice: "Your sign-in has timed out.
+  The code we sent will no longer work. Start sign-in again from the
+  app you came from." The notice carries a single "Start over"
+  button. The OTP boxes, Resend button, and Verify button are all
+  disabled — nothing the user types or clicks on the form will
+  silently fail.
+
+  No automatic redirect. The user makes the choice to click Start
+  over (which navigates to `/auth/abort`). Clicking elsewhere on
+  the page (e.g. the Powered by Certified link) still works as
+  expected.
+
+- **Reactive gates kept for defence in depth.** Even with the
+  proactive notice, race conditions exist (heartbeat hasn't
+  fired yet, user already mid-typing, etc.). Both the Resend click
+  and the Verify submit ping `/auth/ping` first — if it returns
+  `par_expired`, the handler navigates to `/auth/abort` instead of
+  proceeding, so a user who beats the proactive notice still gets
+  cleanly bounced rather than typing a code that won't work.
+
+- **`GET /auth/abort` route.** Browser-driven server-side clean exit.
+  Reads the auth_flow cookie, runs the same `cleanExit()` helper as
+  the unrecoverable-error paths in /auth/complete and
+  /auth/choose-handle: redirect to the OAuth client's `redirect_uri`
+  with `error=access_denied` per RFC 6749 §4.1.2.1, or fall back to
+  a styled "Return to sign in" page when the client is unknown.
+  Cookie is cleared because the flow is being abandoned.
+
+**Why a 3-minute heartbeat interval against a 5-minute window?**
+PAR's sliding inactivity timer (5 min) is reset on every successful
+`requestManager.get()` call upstream. 3 min is comfortably under 5
+and tolerates one missed ping (network blip, suspended tab between
+ticks). Tighter would be wasted requests; looser would risk the timer
+expiring between pings.
+
+**Why slide the timer indefinitely?** The upstream code in
+`@atproto/oauth-provider`'s `request-manager.ts` resets `expiresAt`
+on every successful read by design — sliding-on-touch is the
+intended pattern, not a workaround. The 5-min figure was introduced
+in the initial OAuth provider commit (June 2024) with no inline
+rationale, no subsequent discussion in PR/commit history, and
+nothing in the OAuth/PAR specs that mandates either the value or
+the sliding behaviour. Practical bounds:
+
+- The 60-min auth_flow TTL caps how long heartbeat-driven sliding
+  can keep a PAR alive — once the auth_flow row dies, /auth/ping
+  returns `flow_expired` and the browser stops pinging.
+- The httpOnly `epds_auth_flow` cookie gates `/auth/ping`, so an
+  attacker without the cookie cannot ping.
+- PAR consumption is single-use — once the auth code is issued,
+  the row is deleted.
+
+## Status
+
+- Reproduction scenarios: 4 RED scenarios committed on
+  `fix/otp-resend-after-par-expiry` and now GREEN — they assert
+  "browser lands back at the demo client with an auth error", which
+  the demo translates to `?error=auth_failed`.
+- Audit: complete. All 12 dead-end sites mapped to clusters A / B / C
+  with resolved decisions.
+- Heartbeat impl: landed on commit `b1fc940`. `/auth/ping` route +
+  3-min `setInterval` on OTP form + recovery form. Covered by 15
+  unit tests and one e2e (`@par-heartbeat`).
+- Clean-exit impl: landed on commit `2e4d327`. Six auth-service
+  dead-ends rewired to `cleanExit()`; pds-core's
+  `handleCallbackError` extended with a `signedClientId` fallback
+  (delivered via a new `client_id` field on the HMAC-signed
+  callback). Covered by 7 new pds-core tests, 4 new shared crypto
+  tests, and the four `@otp-and-par-expiry` e2e scenarios.
+- Resend-honesty impl (post-PR-154 user report): `/auth/abort`
+  route + proactive notice on the OTP form + reactive abort gates
+  on Resend / Verify clicks. Resend no longer issues a fresh OTP
+  that cannot complete the flow — instead the user goes straight
+  to the OAuth client with the spec-compliant error redirect.
+  Covered by 4 new auth-abort tests, 7 new login-page render-shape
+  tests, and the new `@resend-after-par-dead` e2e scenario. The
+  pre-existing `@otp-and-par-expiry` and `@multiple-resend`
+  scenarios were updated to match the new contract (the user no
+  longer sees the misleading "OTP expired → Resend → fresh OTP
+  → fails" cycle).
diff --git a/e2e/step-definitions/auth.steps.ts b/e2e/step-definitions/auth.steps.ts
index 2d0a3bb4..bca6225f 100644
--- a/e2e/step-definitions/auth.steps.ts
+++ b/e2e/step-definitions/auth.steps.ts
@@ -346,10 +346,25 @@ Then(
   },
 )
 
-Then('the user can try again', async function (this: EpdsWorld) {
-  const page = getPage(this)
-  await expect(page.locator('.otp-box').first()).toBeEnabled()
-})
+Then(
+  'the OTP entry boxes are visible and enabled',
+  async function (this: EpdsWorld) {
+    const page = getPage(this)
+    const boxes = page.locator('.otp-box')
+    const count = await boxes.count()
+    if (count === 0) {
+      throw new Error('No .otp-box elements found — OTP form is not rendered')
+    }
+    // Every box must be both visible AND enabled. Asserting on .first()
+    // alone hid regressions where a partial form (e.g. a stale
+    // "verifying..." latch on later boxes) blocked further attempts even
+    // though the first box looked fine.
+    for (let i = 0; i < count; i++) {
+      await expect(boxes.nth(i)).toBeVisible()
+      await expect(boxes.nth(i)).toBeEnabled()
+    }
+  },
+)
 
 Then('further attempts are rejected', async function (this: EpdsWorld) {
   const page = getPage(this)
@@ -445,7 +460,11 @@ Then(
   async function (this: EpdsWorld, expected: string) {
     const page = getPage(this)
     await expect(page.locator('#error-msg')).toBeVisible({ timeout: 10_000 })
-    await expect(page.locator('#error-msg')).toHaveText(expected, {
+    // toContainText (not toHaveText) so the OTP-expired error
+    // banner can carry the inline "Send a new code" action button
+    // alongside the message text. Equality matching would fail
+    // whenever the inline action surfaces.
+    await expect(page.locator('#error-msg')).toContainText(expected, {
       timeout: 10_000,
     })
   },
@@ -566,25 +585,45 @@ async function callPdsExpiryHook(
 }
 
 /**
- * Read the PAR request_uri from the current auth-service login page
- * URL and stash it on the world for subsequent expiry hooks. The URL
- * is `https://<auth>/oauth/authorize?request_uri=urn:...&...` while the
- * user is on the login/OTP form. Throws if the URL doesn't carry it,
- * which means the surrounding scenario is mis-ordered (the page must
- * be on the auth-service side before this step runs).
+ * Read the PAR request_uri from the current auth-service page URL and
+ * stash it on the world for subsequent expiry hooks. While the user is
+ * on the login/OTP form the URL is
+ * `https://<auth>/oauth/authorize?request_uri=urn:...&...`, but on
+ * downstream pages (e.g. /auth/recover) the parameter has been dropped.
+ * Falls back to a previously-stashed `world.lastRequestUri` so a
+ * scenario can capture the URI early (via the dedicated capture step
+ * below) and consult it after navigation. Throws when neither source
+ * has a value, which means the scenario is mis-ordered.
  */
 function captureRequestUriFromPage(world: EpdsWorld): string {
   const page = getPage(world)
-  const requestUri = new URL(page.url()).searchParams.get('request_uri')
-  if (!requestUri) {
-    throw new Error(
-      `Expected request_uri in page URL but found none: ${page.url()}`,
-    )
+  const fromUrl = new URL(page.url()).searchParams.get('request_uri')
+  if (fromUrl) {
+    world.lastRequestUri = fromUrl
+    return fromUrl
   }
-  world.lastRequestUri = requestUri
-  return requestUri
+  if (world.lastRequestUri) {
+    return world.lastRequestUri
+  }
+  throw new Error(
+    `Expected request_uri in page URL or previously captured but found none: ${page.url()}`,
+  )
 }
 
+/**
+ * Capture and stash the PAR request_uri from the current auth-service
+ * page URL so a later step can refer to it after navigating away. Used
+ * by scenarios where the OTP form is left for /auth/recover (recovery)
+ * or any other downstream page where the request_uri has dropped off
+ * the URL.
+ */
+When(
+  'the PAR request_uri is captured for later expiry',
+  function (this: EpdsWorld) {
+    captureRequestUriFromPage(this)
+  },
+)
+
 When(
   'the PAR request_uri has expired before the bridge fires',
   async function (this: EpdsWorld) {
@@ -595,43 +634,55 @@ When(
   },
 )
 
-Then('the response body is not raw JSON', async function (this: EpdsWorld) {
-  const page = getPage(this)
-  // The OTP form's submit is JS-driven and async, and Playwright's
-  // fill() returns before the bridge redirects. Wait for the
-  // browser to actually leave the auth-service host and arrive at
-  // pds-core's epds-callback (where, in this scenario, the
-  // catch-block renders the error page). Without this wait we'd
-  // read the still-rendering OTP form's body.
-  const pdsHost = new URL(testEnv.pdsUrl).host
-  await page.waitForURL(
-    (url) => url.host === pdsHost && url.pathname.includes('epds-callback'),
-    { timeout: 30_000 },
-  )
-  const body = await page.locator('body').innerText()
-  // The pre-fix behaviour returned a body that started with
-  // {"error": "Authentication failed"}. A graceful HTML page won't —
-  // its <h1>/<p> text isn't valid JSON. The regex catches any
-  // {"error": ...} shape so a future leak of a different JSON
-  // payload is still caught.
-  if (/^\s*\{\s*"error"/.test(body)) {
-    throw new Error(
-      `pds-core leaked raw JSON to the browser: ${body.slice(0, 200)}`,
-    )
-  }
-})
+// ---------------------------------------------------------------------------
+// Clean-exit assertions for @otp-and-par-expiry scenarios
+// ---------------------------------------------------------------------------
+//
+// When the upstream PAR is hard-dead (the test hook deletes the row),
+// no amount of heartbeat can revive it — but we still owe the user a
+// clean exit per RFC 6749 §4.1.2.1: redirect them back to the OAuth
+// client's redirect_uri with `error=access_denied` so the client's
+// own UI can handle retry. The demo client translates that to
+// `?error=auth_failed` on its landing page.
+
+Then(
+  'the browser lands back at the demo client with an auth error',
+  async function (this: EpdsWorld) {
+    const origin = new URL(testEnv.demoUrl).origin
+    const page = getPage(this)
+    await page.waitForURL(`${origin}/?error=auth_failed*`, {
+      timeout: 30_000,
+    })
+  },
+)
+
+// ---------------------------------------------------------------------------
+// PAR heartbeat liveness (@par-heartbeat)
+// ---------------------------------------------------------------------------
+//
+// The OTP form auto-fires a fetch to /auth/ping every 3 minutes. Waiting
+// 3 minutes wall-clock is unacceptable for an e2e scenario, so this step
+// invokes the same fetch synchronously from the page's own JS context
+// — same origin, same cookies, same browser security boundary — and
+// asserts the response. That proves the wiring (page can reach
+// /auth/ping → auth-service forwards to pds-core's
+// /_internal/ping-request → returns 200) without waiting for the
+// interval to tick.
 
 Then(
-  'the response body explains that sign-in timed out',
+  'a heartbeat fetched from the OTP form returns ok:true',
   async function (this: EpdsWorld) {
     const page = getPage(this)
-    const body = await page.locator('body').innerText()
-    // Don't pin exact wording — just require something that mentions
-    // the timeout / expiry so a human reading it understands why
-    // their sign-in failed.
-    if (!/expir|timed? ?out|too long/i.test(body)) {
+    const body = await page.evaluate(async () => {
+      const r = await fetch('/auth/ping', {
+        credentials: 'include',
+        cache: 'no-store',
+      })
+      return (await r.json()) as { ok: boolean; reason?: string }
+    })
+    if (!body.ok) {
       throw new Error(
-        `Error page should mention the timeout but said: "${body.slice(0, 500)}"`,
+        `Expected /auth/ping to return ok:true but got: ${JSON.stringify(body)}`,
       )
     }
   },
diff --git a/features/passwordless-authentication.feature b/features/passwordless-authentication.feature
index e5a9a589..e13b9f5c 100644
--- a/features/passwordless-authentication.feature
+++ b/features/passwordless-authentication.feature
@@ -264,7 +264,7 @@ Feature: Passwordless authentication via email OTP
     When more than 10 minutes pass before the user enters the OTP
     And the user enters the OTP code
     Then the verification form shows an "OTP expired" error
-    And the user can try again
+    And the OTP entry boxes are visible and enabled
     When the user requests a new OTP via the resend button
     Then a fresh OTP email arrives in the mail trap for the test email
     When the user enters the OTP code
@@ -272,6 +272,156 @@ Feature: Passwordless authentication via email OTP
     Then the browser is redirected back to the demo client
     And the demo client has a valid OAuth access token
 
+  # --- Hard-dead PAR clean-exit scenarios (@otp-and-par-expiry) ---
+  #
+  # These four scenarios reproduce the dead-end pages a real user used
+  # to trip when the upstream PAR (request_uri) row died before the
+  # OAuth flow could complete. Upstream's PAR has a 5-min sliding
+  # inactivity timeout that we cannot bump (hardcoded in
+  # @atproto/oauth-provider) and that, once tripped, deletes the row
+  # in the same call that throws — so no in-flight recovery is
+  # possible.
+  #
+  # The fix is twofold (see docs/design/par-expiry-and-clean-exits.md):
+  #
+  #   1. While the user is on the OTP / recovery form, a 3-min
+  #      heartbeat to /auth/ping slides the PAR's inactivity timer so
+  #      the row stays alive. This is exercised by @par-heartbeat.
+  #
+  #   2. When the PAR is *genuinely* dead (closed tab, walked away,
+  #      explicit upstream cleanup), every dead-end auth-service page
+  #      must redirect the user back to the OAuth client with the
+  #      RFC 6749 §4.1.2.1 error parameters so the client's own UI
+  #      handles retry — never strand them on a static page.
+  #
+  # These scenarios use /_internal/test/delete-par to simulate (2) —
+  # the row is hard-deleted and cannot be revived. The contract they
+  # assert is therefore "land back at the demo client with an auth
+  # error" (the demo translates `error=access_denied` to
+  # `?error=auth_failed` on its landing page), NOT "the OAuth flow
+  # successfully completes". Layer 1 (heartbeat) is what prevents
+  # the dead PAR; layer 2 (clean-exit) is what makes recovery
+  # one-click when prevention fails.
+  @email @otp-and-par-expiry
+  Scenario: Expired OTP + expired PAR — clean exit back to the OAuth client
+    # With the proactive notice + reactive abort gate (added after the
+    # original PR-154 user report) the user no longer goes through the
+    # "OTP expired → Resend → fresh OTP → fails anyway" cycle. The
+    # Verify submit sees the dead PAR via /auth/ping and bails to
+    # /auth/abort directly, so the contract this scenario asserts
+    # is just "lands at the demo client with an auth error" — same
+    # end state, fewer misleading UI steps.
+    When the demo client initiates an OAuth login
+    Then the browser is redirected to the auth service login page
+    And the login page displays an email input form
+    When the user enters a unique test email and submits
+    Then an OTP email arrives in the mail trap for the test email
+    And the login page shows an OTP verification form
+    When more than 10 minutes pass before the user enters the OTP
+    And the PAR request_uri has expired before the bridge fires
+    And the user enters the OTP code
+    Then the browser lands back at the demo client with an auth error
+
+  @email @otp-and-par-expiry @multiple-resend
+  Scenario: Two Resend cycles after silent PAR death — clean exit back to the OAuth client
+    # First Resend cycle works (PAR is still alive). Second Resend
+    # triggers after the PAR has died: the reactive abort gate sees
+    # /auth/ping returns par_expired, so the resend handler bails
+    # to /auth/abort instead of issuing a third OTP that the user
+    # could never use. End state: user is back at the demo client
+    # with the spec-compliant error redirect, NOT in a misleading
+    # "fresh code that won't work" cycle.
+    When the demo client initiates an OAuth login
+    Then the browser is redirected to the auth service login page
+    And the login page displays an email input form
+    When the user enters a unique test email and submits
+    Then an OTP email arrives in the mail trap for the test email
+    And the login page shows an OTP verification form
+    When the user requests a new OTP via the resend button
+    Then a fresh OTP email arrives in the mail trap for the test email
+    When the PAR request_uri has expired before the bridge fires
+    And the user requests a new OTP via the resend button
+    Then the browser lands back at the demo client with an auth error
+
+  @email @otp-and-par-expiry @prompt-login
+  Scenario: prompt=login + expired PAR — clean exit back to the OAuth client
+    Given a returning user has a PDS account
+    When the demo client starts a new OAuth flow with prompt=login
+    And the user enters the test email on the login page
+    Then an OTP email arrives in the mail trap
+    And the login page shows an OTP verification form
+    When the PAR request_uri has expired before the bridge fires
+    And the user enters the OTP code
+    Then the browser lands back at the demo client with an auth error
+
+  @email @otp-and-par-expiry @recovery
+  Scenario: Recovery via backup email + expired PAR — clean exit back to the OAuth client
+    Given a returning user has a PDS account
+    And the test user has a verified backup email
+    And the demo client initiates OAuth with the test email as login_hint
+    # /auth/recover is a plain URL with no request_uri query parameter,
+    # so we must snapshot the request_uri while we're still on the
+    # original /oauth/authorize page (the login_hint step lands here).
+    And the PAR request_uri is captured for later expiry
+    When the user navigates to the recovery page
+    And the user enters the backup email on the recovery page
+    Then an OTP email arrives in the mail trap for the backup email
+    When the PAR request_uri has expired before the bridge fires
+    And the user enters the recovery OTP
+    Then the browser lands back at the demo client with an auth error
+
+  # --- PAR heartbeat (live PAR, no delete) ---
+  #
+  # Proves the in-page heartbeat reaches /auth/ping and that
+  # /auth/ping forwards to pds-core's /_internal/ping-request,
+  # i.e. the wiring works end-to-end through Caddy. This is
+  # heartbeat liveness, not heartbeat efficacy — the unit tests in
+  # heartbeat.test.ts cover routing logic. We don't wall-clock-wait
+  # 5 min for the timer to lapse; instead the browser fires the
+  # heartbeat fetch synchronously from the OTP form's page context
+  # and we assert the response shape.
+  @email @par-heartbeat
+  Scenario: OTP form's heartbeat reaches /auth/ping with ok:true
+    When the demo client initiates an OAuth login
+    Then the browser is redirected to the auth service login page
+    When the user enters a unique test email and submits
+    Then an OTP email arrives in the mail trap for the test email
+    And the login page shows an OTP verification form
+    Then a heartbeat fetched from the OTP form returns ok:true
+
+  # --- Resend after PAR death ---
+  #
+  # If the user lands on the OTP form with the upstream PAR already
+  # dead (>5 min wait, missed heartbeat, suspended tab, etc.), they
+  # should NOT be allowed to click Resend, get a fresh code, type it
+  # in, and only then be told sign-in failed. Offering Resend in
+  # that state is misleading: better-auth would happily issue a new
+  # OTP that pds-core's /oauth/epds-callback would then bounce back
+  # to the OAuth client with error=access_denied because the PAR is
+  # gone and cannot be revived.
+  #
+  # The Resend click handler now pings /auth/ping first. If the
+  # response is `par_expired` (or `flow_expired` / `no_cookie`), the
+  # browser navigates to /auth/abort instead of issuing the new OTP.
+  # /auth/abort runs the same cleanExit() as the unrecoverable-error
+  # paths, so the user lands at the OAuth client with the standard
+  # RFC 6749 §4.1.2.1 error params. No fresh OTP gets issued, no
+  # OTP-typing UX cycle.
+  @email @resend-after-par-dead
+  Scenario: Clicking Resend after the PAR has died bails to the OAuth client without issuing a new OTP
+    When the demo client initiates an OAuth login
+    Then the browser is redirected to the auth service login page
+    When the user enters a unique test email and submits
+    Then an OTP email arrives in the mail trap for the test email
+    And the login page shows an OTP verification form
+    When the PAR request_uri has expired before the bridge fires
+    # The Resend step wipes the inbox before clicking the button, so
+    # the "no new OTP email" assertion below measures the resend
+    # click in isolation rather than the OTP that already arrived.
+    And the user requests a new OTP via the resend button
+    Then the browser lands back at the demo client with an auth error
+    And no new OTP email is sent to the test email
+
   # --- PAR (request_uri) expiry ---
   #
   # The PAR ("Pushed Authorization Request") record lives in pds-core's
@@ -316,18 +466,20 @@ Feature: Passwordless authentication via email OTP
   # The test deletes the PAR row before the callback fires, mirroring
   # the production failure where /oauth/epds-callback's first
   # requestManager.get() (Step 2 in the handler) throws
-  # InvalidRequestError("Unknown request_uri"). With no live PAR row
-  # there is no redirect_uri to recover, so the user must land on a
-  # styled HTML page on the PDS host — not the previous raw JSON
-  # body — explaining that the sign-in timed out.
+  # InvalidRequestError("Unknown request_uri"). The signed callback
+  # URL now carries `client_id` (per the clean-exit work in this PR),
+  # so even though the PAR is dead the catch block can resolve the
+  # client's metadata and redirect the user back to the OAuth client
+  # with the standard RFC 6749 §4.1.2.1 error parameters. The demo
+  # client translates `error=access_denied` into `?error=auth_failed`
+  # on its landing page; that's the contract this scenario asserts.
   #
-  # The redirect-back-to-client path (driven by the redirect_uri /
-  # state captured during a successful Step 2) is exercised by the
-  # other paths inside the same handler that throw later in the
-  # flow; we don't have an easy e2e harness to inject a mid-flow
-  # failure today.
+  # The static HTML fallback inside pds-core's catch block only fires
+  # in the worst case where neither the captured PAR data nor the
+  # signed `client_id` resolves to a usable redirect URI — much
+  # harder to reach now and not exercised here.
   @email @par-callback-error
-  Scenario: Expired PAR shows a styled HTML page instead of leaking JSON
+  Scenario: Expired PAR redirects back to the OAuth client instead of stranding the user
     Given a returning user has a PDS account
     When the demo client initiates an OAuth login
     And the user enters the test email on the login page
@@ -335,8 +487,7 @@ Feature: Passwordless authentication via email OTP
     And the login page shows an OTP verification form
     When the PAR request_uri has expired before the bridge fires
     And the user enters the OTP code
-    Then the response body is not raw JSON
-    And the response body explains that sign-in timed out
+    Then the browser lands back at the demo client with an auth error
 
   # --- Brute force protection ---
 
@@ -344,7 +495,7 @@ Feature: Passwordless authentication via email OTP
     When the user requests an OTP for a unique test email
     And enters an incorrect OTP code
     Then the verification form shows an error message
-    And the user can try again
+    And the OTP entry boxes are visible and enabled
 
   Scenario: Too many failed OTP attempts locks out the token
     When the user requests an OTP for a unique test email
diff --git a/packages/auth-service/src/__tests__/__helpers__/heartbeat-router-harness.ts b/packages/auth-service/src/__tests__/__helpers__/heartbeat-router-harness.ts
new file mode 100644
index 00000000..d0a4af75
--- /dev/null
+++ b/packages/auth-service/src/__tests__/__helpers__/heartbeat-router-harness.ts
@@ -0,0 +1,102 @@
+/**
+ * Shared test harness for the heartbeat router (which now hosts both
+ * GET /auth/ping and GET /auth/abort). Lifted out of the per-route
+ * test files to keep them readable and to keep Sonar's
+ * duplicated-lines gate happy — both files would otherwise carry
+ * the same boilerplate verbatim.
+ */
+import express from 'express'
+import cookieParser from 'cookie-parser'
+import type { AuthServiceContext } from '../../context.js'
+
+export interface FakeFlow {
+  requestUri: string
+  clientId: string | null
+  handleMode: null
+}
+
+/**
+ * Build an Express app with cookie-parser + the heartbeat router
+ * mounted, backed by an in-memory Map of fake auth_flow rows. The
+ * caller passes the `createHeartbeatRouter` factory directly so a
+ * test using `vi.mock` to replace transitive dependencies (e.g.
+ * cleanExit, pingParRequest) doesn't have to import the router
+ * before its mocks are in scope.
+ */
+export function buildHeartbeatApp(
+  createHeartbeatRouter: (ctx: AuthServiceContext) => express.Router,
+  flows: Map<string, FakeFlow>,
+): express.Express {
+  const ctx = {
+    db: {
+      getAuthFlow(flowId: string): FakeFlow | undefined {
+        return flows.get(flowId)
+      },
+    },
+  } as unknown as AuthServiceContext
+  const app = express()
+  app.use(cookieParser())
+  app.use(createHeartbeatRouter(ctx))
+  return app
+}
+
+export interface HarnessResponse {
+  status: number
+  setCookie: string[]
+  location: string | null
+  cacheControl: string | null
+  body: unknown
+}
+
+/**
+ * Spin up the harness on an ephemeral port, GET the supplied path,
+ * tear the server down. The /auth/ping caller wants the JSON body;
+ * the /auth/abort caller wants the redirect Location and Set-Cookie
+ * headers; expose all of them and let each test pick what it cares
+ * about.
+ */
+export async function harnessGet(
+  app: express.Express,
+  path: string,
+  cookie?: string,
+): Promise<HarnessResponse> {
+  const server = app.listen(0)
+  try {
+    server.unref()
+    const port = await new Promise<number>((resolve, reject) => {
+      server.once('error', reject)
+      server.once('listening', () => {
+        const addr = server.address()
+        if (typeof addr === 'object' && addr) resolve(addr.port)
+        else reject(new Error('Failed to resolve ephemeral port'))
+      })
+    })
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+      method: 'GET',
+      headers: cookie ? { Cookie: cookie } : {},
+      redirect: 'manual',
+    })
+    // Body parsing: /auth/ping returns JSON; /auth/abort returns a
+    // redirect with no body. Try JSON; on failure, fall back to
+    // null. Caller decides which result they care about.
+    let body: unknown = null
+    try {
+      body = await res.json()
+    } catch {
+      body = null
+    }
+    return {
+      status: res.status,
+      setCookie: res.headers.getSetCookie(),
+      location: res.headers.get('location'),
+      cacheControl: res.headers.get('cache-control'),
+      body,
+    }
+  } finally {
+    await new Promise<void>((resolve) => {
+      server.close(() => {
+        resolve()
+      })
+    })
+  }
+}
diff --git a/packages/auth-service/src/__tests__/auth-abort.test.ts b/packages/auth-service/src/__tests__/auth-abort.test.ts
new file mode 100644
index 00000000..48f1d696
--- /dev/null
+++ b/packages/auth-service/src/__tests__/auth-abort.test.ts
@@ -0,0 +1,141 @@
+/**
+ * Tests for the /auth/abort browser-driven clean-exit route.
+ *
+ * The route exists so the OTP / recovery forms can bail to the
+ * OAuth client when they detect the flow can no longer complete
+ * (PAR or auth_flow gone). Asserts:
+ *   - cookie is cleared (the flow is being abandoned)
+ *   - cleanExit is called with the right opts (clientId from the
+ *     flow row, access_denied code, "took too long" description)
+ *   - works whether or not a flow row exists (cookie present but
+ *     row gone, vs no cookie at all)
+ */
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  beforeAll,
+  afterAll,
+} from 'vitest'
+import {
+  buildHeartbeatApp,
+  harnessGet,
+  type FakeFlow,
+} from './__helpers__/heartbeat-router-harness.js'
+import type express from 'express'
+
+const PDS_URL = 'https://core:3000'
+const SECRET = 'test-secret'
+const CLIENT_ID = 'https://demo.example/client-metadata.json'
+
+const ORIGINAL_PDS_URL = process.env.PDS_INTERNAL_URL
+const ORIGINAL_SECRET = process.env.EPDS_INTERNAL_SECRET
+
+beforeAll(() => {
+  process.env.PDS_INTERNAL_URL = PDS_URL
+  process.env.EPDS_INTERNAL_SECRET = SECRET
+})
+
+afterAll(() => {
+  if (ORIGINAL_PDS_URL === undefined) delete process.env.PDS_INTERNAL_URL
+  else process.env.PDS_INTERNAL_URL = ORIGINAL_PDS_URL
+  if (ORIGINAL_SECRET === undefined) delete process.env.EPDS_INTERNAL_SECRET
+  else process.env.EPDS_INTERNAL_SECRET = ORIGINAL_SECRET
+})
+
+// Mock cleanExit at the module boundary so we can assert what /auth/abort
+// passes without standing up the full redirect/metadata machinery.
+const cleanExitMock = vi.hoisted(() => vi.fn())
+vi.mock('../lib/clean-exit.js', () => ({
+  cleanExit: cleanExitMock,
+}))
+
+// Stub pingParRequest too — same reason as in heartbeat.test.ts.
+const pingMock = vi.hoisted(() => vi.fn())
+vi.mock('../lib/ping-par-request.js', () => ({
+  pingParRequest: pingMock,
+}))
+
+beforeEach(() => {
+  cleanExitMock.mockReset()
+  cleanExitMock.mockImplementation(({ res }: { res: express.Response }) => {
+    // Simulate a response so the route doesn't hang the test
+    // client. Returns a resolved promise so the route's
+    // `await cleanExit(...)` proceeds normally.
+    res
+      .status(303)
+      .setHeader('Location', 'https://demo.example/?error=auth_failed')
+      .end()
+    return Promise.resolve()
+  })
+  pingMock.mockReset()
+})
+
+const { createHeartbeatRouter } = await import('../routes/heartbeat.js')
+
+function buildApp(flows: Map<string, FakeFlow>): express.Express {
+  return buildHeartbeatApp(createHeartbeatRouter, flows)
+}
+
+async function getAbort(
+  app: express.Express,
+  cookie?: string,
+): Promise<{ status: number; setCookie: string[]; location: string | null }> {
+  const r = await harnessGet(app, '/auth/abort', cookie)
+  return { status: r.status, setCookie: r.setCookie, location: r.location }
+}
+
+describe('GET /auth/abort', () => {
+  it('calls cleanExit with the flow.clientId when the cookie + flow row are alive', async () => {
+    const flows = new Map<string, FakeFlow>([
+      [
+        'flow-1',
+        {
+          requestUri: 'urn:ietf:params:oauth:request_uri:req-abc',
+          clientId: CLIENT_ID,
+          handleMode: null,
+        },
+      ],
+    ])
+    const app = buildApp(flows)
+
+    await getAbort(app, 'epds_auth_flow=flow-1')
+
+    expect(cleanExitMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        clientId: CLIENT_ID,
+        pdsUrl: PDS_URL,
+        code: 'access_denied',
+        description: expect.stringMatching(/took too long/i),
+      }),
+    )
+  })
+
+  it('clears the auth_flow cookie regardless of whether a flow row exists', async () => {
+    const app = buildApp(new Map())
+    const got = await getAbort(app, 'epds_auth_flow=stale-flow-id')
+    // Express sets a cookie with `Max-Age=0` (or `Expires` in the past) to clear it.
+    const cleared = got.setCookie.some((c) =>
+      /epds_auth_flow=;.*Expires=Thu, 01 Jan 1970/.test(c),
+    )
+    expect(cleared).toBe(true)
+  })
+
+  it('passes clientId: null when no cookie is present', async () => {
+    const app = buildApp(new Map())
+    await getAbort(app)
+    expect(cleanExitMock).toHaveBeenCalledWith(
+      expect.objectContaining({ clientId: null }),
+    )
+  })
+
+  it('passes clientId: null when the cookie points to a non-existent flow', async () => {
+    const app = buildApp(new Map())
+    await getAbort(app, 'epds_auth_flow=missing-flow')
+    expect(cleanExitMock).toHaveBeenCalledWith(
+      expect.objectContaining({ clientId: null }),
+    )
+  })
+})
diff --git a/packages/auth-service/src/__tests__/build-epds-callback-url.test.ts b/packages/auth-service/src/__tests__/build-epds-callback-url.test.ts
new file mode 100644
index 00000000..faf25ab1
--- /dev/null
+++ b/packages/auth-service/src/__tests__/build-epds-callback-url.test.ts
@@ -0,0 +1,213 @@
+/**
+ * Tests for buildEpdsCallbackUrl — the HMAC-signed callback URL that
+ * /auth/complete (and /auth/choose-handle) emit to bridge the user
+ * from auth-service into pds-core. Covers the two contracts that
+ * matter beyond round-trip: client_id is signed in, and the
+ * random-mode handle sentinel is preserved.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+
+const ORIGINAL_PDS_URL = process.env.PDS_INTERNAL_URL
+const ORIGINAL_SECRET = process.env.EPDS_INTERNAL_SECRET
+
+beforeAll(() => {
+  // Importing complete.ts pulls in lib/clean-exit.js which calls
+  // requireInternalEnv() at router-creation time. We don't actually
+  // call createCompleteRouter from these tests, but the import side
+  // effects still fire, so satisfy them.
+  process.env.PDS_INTERNAL_URL = 'https://core:3000'
+  process.env.EPDS_INTERNAL_SECRET = 'test-secret'
+})
+
+afterAll(() => {
+  if (ORIGINAL_PDS_URL === undefined) delete process.env.PDS_INTERNAL_URL
+  else process.env.PDS_INTERNAL_URL = ORIGINAL_PDS_URL
+  if (ORIGINAL_SECRET === undefined) delete process.env.EPDS_INTERNAL_SECRET
+  else process.env.EPDS_INTERNAL_SECRET = ORIGINAL_SECRET
+})
+
+import { buildEpdsCallbackUrl } from '../routes/complete.js'
+import { verifyCallback, type CallbackParams } from '@certified-app/shared'
+
+const PDS_PUBLIC_URL = 'https://pds.example'
+const SECRET = 'test-callback-secret'
+const REQUEST_URI = 'urn:ietf:params:oauth:request_uri:req-abc'
+const EMAIL = 'user@example.com'
+const CLIENT_ID = 'https://demo.example/client-metadata.json'
+
+function paramsFromUrl(url: string): URLSearchParams {
+  return new URL(url).searchParams
+}
+
+/**
+ * Read a required URL param. Throws if absent — tests that get here
+ * have already asserted the param was set, so a missing value is a
+ * test-fixture bug, not a runtime branch we want to handle silently.
+ * Avoids the non-null `!` assertion on every `.get()` call.
+ */
+function requiredParam(q: URLSearchParams, name: string): string {
+  const v = q.get(name)
+  if (v === null) throw new Error(`expected URL param ${name} to be set`)
+  return v
+}
+
+describe('buildEpdsCallbackUrl', () => {
+  it('targets pds-core /oauth/epds-callback at the configured public URL', () => {
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: REQUEST_URI,
+      flowClientId: CLIENT_ID,
+      email: EMAIL,
+      isNewAccount: false,
+      pdsPublicUrl: PDS_PUBLIC_URL,
+      epdsCallbackSecret: SECRET,
+    })
+    const u = new URL(url)
+    expect(u.origin).toBe(PDS_PUBLIC_URL)
+    expect(u.pathname).toBe('/oauth/epds-callback')
+  })
+
+  it('round-trips via verifyCallback for an existing user', () => {
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: REQUEST_URI,
+      flowClientId: CLIENT_ID,
+      email: EMAIL,
+      isNewAccount: false,
+      pdsPublicUrl: PDS_PUBLIC_URL,
+      epdsCallbackSecret: SECRET,
+    })
+    const q = paramsFromUrl(url)
+    expect(q.get('approved')).toBe('1')
+    expect(q.get('new_account')).toBe('0')
+    expect(q.get('email')).toBe(EMAIL)
+    expect(q.get('request_uri')).toBe(REQUEST_URI)
+    expect(q.get('client_id')).toBe(CLIENT_ID)
+
+    const ts = requiredParam(q, 'ts')
+    const sig = requiredParam(q, 'sig')
+    const params: CallbackParams = {
+      request_uri: REQUEST_URI,
+      email: EMAIL,
+      approved: '1',
+      new_account: '0',
+      client_id: CLIENT_ID,
+    }
+    expect(verifyCallback(params, ts, sig, SECRET)).toBe(true)
+  })
+
+  it('round-trips via verifyCallback for a new account', () => {
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: REQUEST_URI,
+      flowClientId: CLIENT_ID,
+      email: EMAIL,
+      isNewAccount: true,
+      pdsPublicUrl: PDS_PUBLIC_URL,
+      epdsCallbackSecret: SECRET,
+    })
+    const q = paramsFromUrl(url)
+    expect(q.get('new_account')).toBe('1')
+    const params: CallbackParams = {
+      request_uri: REQUEST_URI,
+      email: EMAIL,
+      approved: '1',
+      new_account: '1',
+      client_id: CLIENT_ID,
+    }
+    expect(
+      verifyCallback(
+        params,
+        requiredParam(q, 'ts'),
+        requiredParam(q, 'sig'),
+        SECRET,
+      ),
+    ).toBe(true)
+  })
+
+  it('omits client_id from the URL when flowClientId is null', () => {
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: REQUEST_URI,
+      flowClientId: null,
+      email: EMAIL,
+      isNewAccount: false,
+      pdsPublicUrl: PDS_PUBLIC_URL,
+      epdsCallbackSecret: SECRET,
+    })
+    const q = paramsFromUrl(url)
+    expect(q.has('client_id')).toBe(false)
+    // And it still round-trips via verifyCallback (the signed payload
+    // uses the empty-string sentinel for absent client_id).
+    const params: CallbackParams = {
+      request_uri: REQUEST_URI,
+      email: EMAIL,
+      approved: '1',
+      new_account: '0',
+    }
+    expect(
+      verifyCallback(
+        params,
+        requiredParam(q, 'ts'),
+        requiredParam(q, 'sig'),
+        SECRET,
+      ),
+    ).toBe(true)
+  })
+
+  it('preserves the random-mode handle sentinel: omitting `handle` is the trigger for pds-core to call generateRandomHandle()', () => {
+    // Neither the inputs to buildEpdsCallbackUrl nor the output URL
+    // carry a `handle` field — the absence is the signal. This pins
+    // the contract documented in the function's JSDoc.
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: REQUEST_URI,
+      flowClientId: CLIENT_ID,
+      email: EMAIL,
+      isNewAccount: true,
+      pdsPublicUrl: PDS_PUBLIC_URL,
+      epdsCallbackSecret: SECRET,
+    })
+    const q = paramsFromUrl(url)
+    expect(q.has('handle')).toBe(false)
+    // verifyCallback with absent handle accepts the signature, mirroring
+    // the sentinel test in shared/src/__tests__/crypto.test.ts.
+    const params: CallbackParams = {
+      request_uri: REQUEST_URI,
+      email: EMAIL,
+      approved: '1',
+      new_account: '1',
+      client_id: CLIENT_ID,
+    }
+    expect(
+      verifyCallback(
+        params,
+        requiredParam(q, 'ts'),
+        requiredParam(q, 'sig'),
+        SECRET,
+      ),
+    ).toBe(true)
+  })
+
+  it("rejects a tampered client_id at the verifier (the value is signed, an attacker cannot redirect a victim's flow at a different OAuth client)", () => {
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: REQUEST_URI,
+      flowClientId: CLIENT_ID,
+      email: EMAIL,
+      isNewAccount: false,
+      pdsPublicUrl: PDS_PUBLIC_URL,
+      epdsCallbackSecret: SECRET,
+    })
+    const q = paramsFromUrl(url)
+    const tampered: CallbackParams = {
+      request_uri: REQUEST_URI,
+      email: EMAIL,
+      approved: '1',
+      new_account: '0',
+      client_id: 'https://attacker.example/client-metadata.json',
+    }
+    expect(
+      verifyCallback(
+        tampered,
+        requiredParam(q, 'ts'),
+        requiredParam(q, 'sig'),
+        SECRET,
+      ),
+    ).toBe(false)
+  })
+})
diff --git a/packages/auth-service/src/__tests__/clean-exit.test.ts b/packages/auth-service/src/__tests__/clean-exit.test.ts
new file mode 100644
index 00000000..19f4924c
--- /dev/null
+++ b/packages/auth-service/src/__tests__/clean-exit.test.ts
@@ -0,0 +1,356 @@
+/**
+ * Tests for cleanExit() — the response emitter that turns "session
+ * expired" dead-ends into clean RFC 6749 §4.1.2.1 redirects (Tier 1)
+ * or a styled HTML page with a Start Over button (Tier 2). Drives
+ * every branch by mocking buildClientErrorRedirect (the URL builder
+ * that hits the network in production) and resolveClientMetadata
+ * (the Tier-2 client_uri lookup) at the module boundary.
+ */
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  beforeAll,
+  afterAll,
+} from 'vitest'
+import type { Response } from 'express'
+
+const PDS_URL = 'https://pds.example'
+const CLIENT_ID = 'https://demo.example/client-metadata.json'
+const REDIRECT_URI = 'https://demo.example/api/oauth/callback'
+
+const ORIGINAL_PDS_URL = process.env.PDS_INTERNAL_URL
+const ORIGINAL_SECRET = process.env.EPDS_INTERNAL_SECRET
+
+beforeAll(() => {
+  // Same as the redirect-to-client-error test — sibling module imports
+  // require these env vars at evaluation time.
+  process.env.PDS_INTERNAL_URL = 'https://core:3000'
+  process.env.EPDS_INTERNAL_SECRET = 'test-secret'
+})
+
+afterAll(() => {
+  if (ORIGINAL_PDS_URL === undefined) delete process.env.PDS_INTERNAL_URL
+  else process.env.PDS_INTERNAL_URL = ORIGINAL_PDS_URL
+  if (ORIGINAL_SECRET === undefined) delete process.env.EPDS_INTERNAL_SECRET
+  else process.env.EPDS_INTERNAL_SECRET = ORIGINAL_SECRET
+})
+
+const buildRedirectMock = vi.hoisted(() => vi.fn())
+// Mock the start-over-href resolver at the shared package boundary
+// rather than the underlying resolveClientMetadata, because the
+// resolver's internal call path uses a relative import that vi.mock
+// can't intercept transitively.
+const resolveStartOverHrefMock = vi.hoisted(() => vi.fn())
+
+vi.mock('../lib/redirect-to-client-error.js', () => ({
+  buildClientErrorRedirect: buildRedirectMock,
+}))
+vi.mock('@certified-app/shared', async (importActual) => {
+  const actual = await importActual<Record<string, unknown>>()
+  return {
+    ...actual,
+    resolveStartOverHref: resolveStartOverHrefMock,
+  }
+})
+
+import { cleanExit } from '../lib/clean-exit.js'
+
+beforeEach(() => {
+  buildRedirectMock.mockReset()
+  resolveStartOverHrefMock.mockReset()
+})
+
+/** Build a minimal Response double that records the calls cleanExit
+ *  makes on it. Same shape as the epds-callback-error test stub. */
+function makeResStub() {
+  const headers: Record<string, string> = {}
+  let statusCode: number | undefined
+  let contentType: string | undefined
+  let body: string | undefined
+  let redirectStatus: number | undefined
+  let redirectLocation: string | undefined
+
+  const res = {
+    setHeader(name: string, value: string) {
+      headers[name.toLowerCase()] = value
+      return res
+    },
+    status(code: number) {
+      statusCode = code
+      return res
+    },
+    type(t: string) {
+      contentType = t
+      return res
+    },
+    send(s: string) {
+      body = s
+      return res
+    },
+    redirect(status: number, location: string) {
+      redirectStatus = status
+      redirectLocation = location
+    },
+  } as unknown as Response
+
+  return {
+    res,
+    inspect: () => ({
+      headers,
+      statusCode,
+      contentType,
+      body,
+      redirectStatus,
+      redirectLocation,
+    }),
+  }
+}
+
+describe('cleanExit — Tier 1 (redirect to OAuth client)', () => {
+  it('issues a 303 redirect to the URL built by buildClientErrorRedirect when clientId is present', async () => {
+    const target = `${REDIRECT_URI}?error=access_denied&error_description=expired&iss=${encodeURIComponent(PDS_URL)}`
+    buildRedirectMock.mockResolvedValueOnce(target)
+    const { res, inspect } = makeResStub()
+
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'Sign-in took too long.',
+    })
+
+    const got = inspect()
+    expect(got.redirectStatus).toBe(303)
+    expect(got.redirectLocation).toBe(target)
+    // The URL builder should have received our exact opts.
+    expect(buildRedirectMock).toHaveBeenCalledWith({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'Sign-in took too long.',
+      state: undefined,
+    })
+    // No Start Over lookup needed — the redirect path doesn't fall
+    // through to the styled HTML.
+    expect(resolveStartOverHrefMock).not.toHaveBeenCalled()
+    // No HTML body emitted.
+    expect(got.body).toBeUndefined()
+  })
+
+  it('forwards state to buildClientErrorRedirect', async () => {
+    buildRedirectMock.mockResolvedValueOnce('https://demo.example/cb?error=...')
+    const { res } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'server_error',
+      description: 'd',
+      state: 'XNMi',
+    })
+    expect(buildRedirectMock).toHaveBeenCalledWith(
+      expect.objectContaining({ state: 'XNMi' }),
+    )
+  })
+
+  it('sets Cache-Control: no-store on the redirect path', async () => {
+    buildRedirectMock.mockResolvedValueOnce('https://demo.example/cb?error=...')
+    const { res, inspect } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(inspect().headers['cache-control']).toBe('no-store')
+  })
+})
+
+describe('cleanExit — Tier 2 (Start Over fallback when redirect fails)', () => {
+  it('renders the styled HTML page with a Start Over button using the resolved href', async () => {
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce('https://demo.example/')
+    const { res, inspect } = makeResStub()
+
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'Sign-in took too long.',
+    })
+
+    const got = inspect()
+    expect(got.redirectLocation).toBeUndefined()
+    expect(got.statusCode).toBe(400)
+    expect(got.contentType).toBe('html')
+    expect(got.body).toContain('Sign-in took too long.')
+    expect(got.body).toContain('class="start-over"')
+    expect(got.body).toContain('href="https://demo.example/"')
+    expect(got.body).toContain('>Return to sign in</a>')
+    // The Start Over resolver is responsible for picking client_uri /
+    // origin / sanitising schemes — that logic is owned (and unit
+    // tested) by `@certified-app/shared`'s start-over-href.test.ts.
+    // cleanExit just trusts whatever the resolver returns.
+    expect(resolveStartOverHrefMock).toHaveBeenCalledWith(
+      CLIENT_ID,
+      expect.any(Object),
+    )
+  })
+
+  it('omits the Start Over button when the resolver returns null', async () => {
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const { res, inspect } = makeResStub()
+
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+
+    const got = inspect()
+    expect(got.body).not.toContain('class="start-over"')
+    expect(got.body).toContain('d')
+  })
+
+  it('honours fallbackStatus override (e.g. 500 for server_error)', async () => {
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const { res, inspect } = makeResStub()
+
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'server_error',
+      description: 'Internal failure',
+      fallbackStatus: 500,
+    })
+    expect(inspect().statusCode).toBe(500)
+  })
+
+  it('uses "Authentication failed" as the fallback title for server_error code', async () => {
+    // Mismatched title vs body would mis-diagnose the failure for both
+    // users and operators — the body says "internal failure" so the
+    // heading shouldn't say "Sign-in session expired".
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const { res, inspect } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'server_error',
+      description: 'Internal failure',
+    })
+    const body = inspect().body!
+    expect(body).toContain('<title>Authentication failed</title>')
+    expect(body).toContain('<h1>Authentication failed</h1>')
+    expect(body).not.toContain('Sign-in session expired')
+  })
+
+  it('uses "Sign-in session expired" as the fallback title for access_denied code', async () => {
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const { res, inspect } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'Sign-in took too long.',
+    })
+    const body = inspect().body!
+    expect(body).toContain('<title>Sign-in session expired</title>')
+    expect(body).not.toContain('Authentication failed')
+  })
+
+  it('honours an explicit fallbackTitle override regardless of code', async () => {
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const { res, inspect } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+      fallbackTitle: 'Custom heading',
+    })
+    expect(inspect().body).toContain('<title>Custom heading</title>')
+  })
+
+  it('sets Cache-Control: no-store on the HTML fallback too', async () => {
+    buildRedirectMock.mockResolvedValueOnce(null)
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const { res, inspect } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(inspect().headers['cache-control']).toBe('no-store')
+  })
+})
+
+describe('cleanExit — no clientId in scope', () => {
+  it('skips Tier 1 entirely and renders a button-less HTML page', async () => {
+    const { res, inspect } = makeResStub()
+
+    await cleanExit({
+      res,
+      clientId: null,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'Your sign-in took too long.',
+    })
+
+    const got = inspect()
+    // No Start Over lookup, no redirect builder call, no Start Over
+    // button — there's nothing to link to.
+    expect(buildRedirectMock).not.toHaveBeenCalled()
+    expect(resolveStartOverHrefMock).not.toHaveBeenCalled()
+    expect(got.redirectLocation).toBeUndefined()
+    expect(got.statusCode).toBe(400)
+    expect(got.contentType).toBe('html')
+    expect(got.body).toContain('Your sign-in took too long.')
+    expect(got.body).not.toContain('class="start-over"')
+  })
+
+  it('treats undefined clientId the same as null', async () => {
+    const { res, inspect } = makeResStub()
+
+    await cleanExit({
+      res,
+      clientId: undefined,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+
+    expect(buildRedirectMock).not.toHaveBeenCalled()
+    expect(inspect().contentType).toBe('html')
+  })
+
+  it('still sets Cache-Control: no-store when no clientId is in scope', async () => {
+    const { res, inspect } = makeResStub()
+    await cleanExit({
+      res,
+      clientId: null,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(inspect().headers['cache-control']).toBe('no-store')
+  })
+})
diff --git a/packages/auth-service/src/__tests__/heartbeat-toggle.test.ts b/packages/auth-service/src/__tests__/heartbeat-toggle.test.ts
new file mode 100644
index 00000000..cb05ed42
--- /dev/null
+++ b/packages/auth-service/src/__tests__/heartbeat-toggle.test.ts
@@ -0,0 +1,144 @@
+/**
+ * Tests for the server-side and rendered-page sides of the PAR-heartbeat
+ * test toggle.
+ *
+ * Two surfaces:
+ *   1. heartbeatEnabledFor(req) — the function login-page.ts and
+ *      recovery.ts call to decide whether to inline the heartbeat
+ *      fetch into the page.
+ *   2. The rendered HTML — a smoke test that proves the OTP form and
+ *      recovery OTP form actually contain (or omit) the /auth/ping
+ *      fetch wired up by the toggle.
+ */
+import { describe, it, expect, afterEach } from 'vitest'
+import type { Request } from 'express'
+import { heartbeatEnabledFor, renderLoginPage } from '../routes/login-page.js'
+import { renderRecoveryOtpForm } from '../routes/recovery.js'
+
+const ORIGINAL_TEST_HOOKS = process.env.EPDS_TEST_HOOKS
+
+afterEach(() => {
+  if (ORIGINAL_TEST_HOOKS === undefined) delete process.env.EPDS_TEST_HOOKS
+  else process.env.EPDS_TEST_HOOKS = ORIGINAL_TEST_HOOKS
+})
+
+function reqWith(query: Record<string, string>): Request {
+  return { query, body: undefined } as unknown as Request
+}
+
+function reqWithBody(body: Record<string, string>): Request {
+  return { query: {}, body } as unknown as Request
+}
+
+describe('heartbeatEnabledFor', () => {
+  it('is enabled by default in production (no test hooks)', () => {
+    delete process.env.EPDS_TEST_HOOKS
+    expect(heartbeatEnabledFor(reqWith({}))).toBe(true)
+  })
+
+  it('ignores no_heartbeat=1 when EPDS_TEST_HOOKS is unset', () => {
+    delete process.env.EPDS_TEST_HOOKS
+    expect(heartbeatEnabledFor(reqWith({ no_heartbeat: '1' }))).toBe(true)
+  })
+
+  it('is enabled when EPDS_TEST_HOOKS=1 but no_heartbeat is unset', () => {
+    process.env.EPDS_TEST_HOOKS = '1'
+    expect(heartbeatEnabledFor(reqWith({}))).toBe(true)
+  })
+
+  it('is disabled when both EPDS_TEST_HOOKS=1 AND no_heartbeat=1', () => {
+    process.env.EPDS_TEST_HOOKS = '1'
+    expect(heartbeatEnabledFor(reqWith({ no_heartbeat: '1' }))).toBe(false)
+  })
+
+  it('does not match arbitrary truthy no_heartbeat values', () => {
+    // Tighten the toggle: only '1' disables. Anything else (incl. 'true')
+    // is treated as a no-op rather than a footgun.
+    process.env.EPDS_TEST_HOOKS = '1'
+    expect(heartbeatEnabledFor(reqWith({ no_heartbeat: 'true' }))).toBe(true)
+  })
+
+  it('honours no_heartbeat=1 in form-encoded request bodies', () => {
+    // The recovery flow's POST handlers re-render the form from
+    // body fields, not query params, so the toggle must work
+    // through req.body for symmetry with req.query.
+    process.env.EPDS_TEST_HOOKS = '1'
+    expect(heartbeatEnabledFor(reqWithBody({ no_heartbeat: '1' }))).toBe(false)
+  })
+
+  it('treats body.no_heartbeat as disabled only on the literal string "1"', () => {
+    process.env.EPDS_TEST_HOOKS = '1'
+    expect(heartbeatEnabledFor(reqWithBody({ no_heartbeat: 'true' }))).toBe(
+      true,
+    )
+    expect(heartbeatEnabledFor(reqWithBody({}))).toBe(true)
+  })
+
+  it('ignores body.no_heartbeat when EPDS_TEST_HOOKS is unset', () => {
+    delete process.env.EPDS_TEST_HOOKS
+    expect(heartbeatEnabledFor(reqWithBody({ no_heartbeat: '1' }))).toBe(true)
+  })
+})
+
+function renderLoginPageWithHeartbeat(heartbeatEnabled: boolean): string {
+  return renderLoginPage({
+    flowId: 'flow-1',
+    clientId: 'https://example.com/client-metadata.json',
+    clientName: 'Example',
+    branding: {},
+    customCss: null,
+    customFaviconUrl: null,
+    customFaviconUrlDark: null,
+    loginHint: '',
+    initialStep: 'email',
+    otpAlreadySent: false,
+    csrfToken: 'csrf',
+    authBasePath: '/api/auth',
+    pdsPublicUrl: 'https://pds.example.com',
+    otpLength: 6,
+    otpCharset: 'numeric',
+    heartbeatEnabled,
+  })
+}
+
+function renderRecoveryOtpFormWithHeartbeat(heartbeatEnabled: boolean): string {
+  return renderRecoveryOtpForm({
+    email: 'user@example.com',
+    csrfToken: 'csrf',
+    requestUri: 'urn:ietf:params:oauth:request_uri:req-abc',
+    otpLength: 6,
+    otpCharset: 'numeric',
+    heartbeatEnabled,
+  })
+}
+
+describe('renderLoginPage heartbeat wiring', () => {
+  it('inlines /auth/ping when heartbeat is enabled', () => {
+    const html = renderLoginPageWithHeartbeat(true)
+    expect(html).toContain("'/auth/ping'")
+    expect(html).toContain('var heartbeatEnabled = true;')
+  })
+
+  it('emits a disabled flag when heartbeat is off', () => {
+    const html = renderLoginPageWithHeartbeat(false)
+    expect(html).toContain('var heartbeatEnabled = false;')
+    // The fetch literal is still in the bundle, gated at runtime by
+    // the flag — that's fine and matches how the IIFE composes.
+    // What matters: the flag is false.
+  })
+})
+
+describe('renderRecoveryOtpForm heartbeat wiring', () => {
+  it('inlines /auth/ping when heartbeat is enabled', () => {
+    const html = renderRecoveryOtpFormWithHeartbeat(true)
+    expect(html).toContain("'/auth/ping'")
+    // The if-guard at the top of the recovery script reads the flag
+    // and bails when false, so check the flag's compile-time value.
+    expect(html).toContain('if (!true) return;')
+  })
+
+  it('emits an early-return guard when heartbeat is off', () => {
+    const html = renderRecoveryOtpFormWithHeartbeat(false)
+    expect(html).toContain('if (!false) return;')
+  })
+})
diff --git a/packages/auth-service/src/__tests__/heartbeat.test.ts b/packages/auth-service/src/__tests__/heartbeat.test.ts
new file mode 100644
index 00000000..7eec2398
--- /dev/null
+++ b/packages/auth-service/src/__tests__/heartbeat.test.ts
@@ -0,0 +1,200 @@
+/**
+ * Tests for the /auth/ping heartbeat route.
+ *
+ * Strategy: stand up the router with a hand-rolled `ctx` that satisfies
+ * just the slice the route reads (`db.getAuthFlow`). Mock
+ * `pingParRequest` at the module boundary so we can assert what the
+ * route forwards to it without hitting (or having to spy on) the
+ * test's own fetch back into the in-process express server.
+ */
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  beforeAll,
+  afterAll,
+} from 'vitest'
+import {
+  buildHeartbeatApp,
+  harnessGet,
+  type FakeFlow,
+} from './__helpers__/heartbeat-router-harness.js'
+import type express from 'express'
+
+// Use https:// in the test fixture so SonarQube's S5332 hotspot doesn't
+// flag this file. The mocked pingParRequest never actually issues a
+// request — the literal flows from process.env to the route handler
+// and back out as a positional argument we assert on.
+const PDS_URL = 'https://core:3000'
+const SECRET = 'test-secret'
+
+const ORIGINAL_PDS_URL = process.env.PDS_INTERNAL_URL
+const ORIGINAL_SECRET = process.env.EPDS_INTERNAL_SECRET
+
+beforeAll(() => {
+  process.env.PDS_INTERNAL_URL = PDS_URL
+  process.env.EPDS_INTERNAL_SECRET = SECRET
+})
+
+afterAll(() => {
+  if (ORIGINAL_PDS_URL === undefined) delete process.env.PDS_INTERNAL_URL
+  else process.env.PDS_INTERNAL_URL = ORIGINAL_PDS_URL
+  if (ORIGINAL_SECRET === undefined) delete process.env.EPDS_INTERNAL_SECRET
+  else process.env.EPDS_INTERNAL_SECRET = ORIGINAL_SECRET
+})
+
+// Mock the ping-par-request module so we can drive the route's success
+// and failure branches without standing up a fake pds-core server.
+const pingMock = vi.hoisted(() => vi.fn())
+vi.mock('../lib/ping-par-request.js', () => ({
+  pingParRequest: pingMock,
+}))
+
+beforeEach(() => {
+  pingMock.mockReset()
+})
+
+// Late import so the vi.mock above is in effect.
+const { createHeartbeatRouter } = await import('../routes/heartbeat.js')
+
+function buildApp(flows: Map<string, FakeFlow>): express.Express {
+  return buildHeartbeatApp(createHeartbeatRouter, flows)
+}
+
+async function getPing(
+  app: express.Express,
+  cookie?: string,
+): Promise<{ status: number; cacheControl: string | null; body: unknown }> {
+  const r = await harnessGet(app, '/auth/ping', cookie)
+  return { status: r.status, cacheControl: r.cacheControl, body: r.body }
+}
+
+describe('GET /auth/ping', () => {
+  it('returns no_cookie when the auth_flow cookie is missing', async () => {
+    const app = buildApp(new Map())
+
+    const res = await getPing(app)
+
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({ ok: false, reason: 'no_cookie' })
+    // We do NOT call pds-core when there is nothing to ping.
+    expect(pingMock).not.toHaveBeenCalled()
+  })
+
+  it('returns flow_expired when the auth_flow row is gone', async () => {
+    const app = buildApp(new Map())
+
+    const res = await getPing(app, 'epds_auth_flow=missing-flow')
+
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({ ok: false, reason: 'flow_expired' })
+    expect(pingMock).not.toHaveBeenCalled()
+  })
+
+  it('forwards a successful ping and returns ok:true', async () => {
+    const flows = new Map<string, FakeFlow>([
+      [
+        'flow-1',
+        {
+          requestUri: 'urn:ietf:params:oauth:request_uri:req-abc',
+          clientId: 'https://demo.example.com/client-metadata.json',
+          handleMode: null,
+        },
+      ],
+    ])
+    const app = buildApp(flows)
+    pingMock.mockResolvedValueOnce({ ok: true })
+
+    const res = await getPing(app, 'epds_auth_flow=flow-1')
+
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({ ok: true })
+    expect(pingMock).toHaveBeenCalledTimes(1)
+    expect(pingMock).toHaveBeenCalledWith(
+      'urn:ietf:params:oauth:request_uri:req-abc',
+      PDS_URL,
+      SECRET,
+    )
+  })
+
+  it('returns par_expired when pds-core reports the request_uri is gone', async () => {
+    const flows = new Map<string, FakeFlow>([
+      [
+        'flow-1',
+        {
+          requestUri: 'urn:ietf:params:oauth:request_uri:req-dead',
+          clientId: null,
+          handleMode: null,
+        },
+      ],
+    ])
+    const app = buildApp(flows)
+    pingMock.mockResolvedValueOnce({ ok: false, status: 404 })
+
+    const res = await getPing(app, 'epds_auth_flow=flow-1')
+
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({ ok: false, reason: 'par_expired' })
+  })
+
+  it('returns transient on operational errors so the browser keeps polling', async () => {
+    const flows = new Map<string, FakeFlow>([
+      [
+        'flow-1',
+        {
+          requestUri: 'urn:ietf:params:oauth:request_uri:req-blip',
+          clientId: null,
+          handleMode: null,
+        },
+      ],
+    ])
+    const app = buildApp(flows)
+    pingMock.mockResolvedValueOnce({ ok: false, status: 502 })
+
+    const res = await getPing(app, 'epds_auth_flow=flow-1')
+
+    // Only a 404 from pds-core terminates keepalive — a 5xx blip
+    // (or any non-404 failure) is reported as transient so the
+    // browser keeps polling and the next tick can recover. Treating
+    // a single dropped packet as terminal would re-introduce the
+    // dead-end the heartbeat exists to prevent.
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({ ok: false, reason: 'transient' })
+  })
+
+  it('returns transient when pingParRequest reports a thrown error (no status)', async () => {
+    const flows = new Map<string, FakeFlow>([
+      [
+        'flow-1',
+        {
+          requestUri: 'urn:ietf:params:oauth:request_uri:req-throw',
+          clientId: null,
+          handleMode: null,
+        },
+      ],
+    ])
+    const app = buildApp(flows)
+    // pingParRequest catches network/timeout errors and reports them
+    // as `{ ok: false, err }` with no `status` field. Same transient
+    // semantics — the next tick may recover.
+    pingMock.mockResolvedValueOnce({
+      ok: false,
+      err: new Error('network blip'),
+    })
+
+    const res = await getPing(app, 'epds_auth_flow=flow-1')
+
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({ ok: false, reason: 'transient' })
+  })
+
+  it('sets Cache-Control: no-store so a shared cache cannot serve a stale response across flows', async () => {
+    const app = buildApp(new Map())
+
+    const res = await getPing(app)
+
+    expect(res.cacheControl).toBe('no-store')
+  })
+})
diff --git a/packages/auth-service/src/__tests__/login-page.test.ts b/packages/auth-service/src/__tests__/login-page.test.ts
index 4c28a586..5376f713 100644
--- a/packages/auth-service/src/__tests__/login-page.test.ts
+++ b/packages/auth-service/src/__tests__/login-page.test.ts
@@ -430,6 +430,7 @@ describe('renderLoginPage handle login button', () => {
       pdsPublicUrl: 'https://pds.example.com',
       otpLength: 6,
       otpCharset: 'numeric',
+      heartbeatEnabled: false,
     })
   }
 
@@ -516,6 +517,7 @@ function renderDefault(): string {
     pdsPublicUrl: 'https://pds.example.com',
     otpLength: 6,
     otpCharset: 'numeric',
+    heartbeatEnabled: false,
   })
 }
 
@@ -570,7 +572,168 @@ describe('renderLoginPage OTP verify-form double-submit latch (regression)', ()
     const branchEnd = html.indexOf('verifying = false;', branchStart)
     expect(branchEnd).toBeGreaterThan(branchStart)
     const branch = html.slice(branchStart, branchEnd)
-    expect(branch).toContain('showError(result.error);')
+    // Either the plain showError or the inline-action variant is fine
+    // (both surface the message to the user); just assert SOME error
+    // surface is invoked.
+    expect(branch).toMatch(/showError(?:WithAction)?\(/)
     expect(branch).toContain('clearOtpBoxes();')
   })
 })
+
+describe('renderLoginPage inline Resend action on expired OTP', () => {
+  // The OTP-expired error used to surface only as "OTP expired" /
+  // "Invalid or expired code" text inside the error banner. Users
+  // missed the separate Resend button below the form. The inline
+  // action button surfaces "Send a new code" right next to the
+  // error message and triggers the same Resend flow.
+
+  it('declares showErrorWithAction with a textContent-only label sink', () => {
+    const html = renderDefault()
+    expect(html).toContain('function showErrorWithAction(')
+    // The label is set via .textContent, never via innerHTML — a
+    // reflected error string that happened to look like HTML must
+    // not be able to inject script tags.
+    const fnStart = html.indexOf('function showErrorWithAction(')
+    expect(fnStart).toBeGreaterThan(0)
+    const fnEnd = html.indexOf('function clearError', fnStart)
+    expect(fnEnd).toBeGreaterThan(fnStart)
+    const fnBody = html.slice(fnStart, fnEnd)
+    expect(fnBody).toContain('btn.textContent = actionLabel')
+    expect(fnBody).not.toContain('innerHTML')
+  })
+
+  it('detects OTP-expired errors via a substring-stable regex', () => {
+    const html = renderDefault()
+    // The detection must catch:
+    //   - better-auth's "Invalid or expired code"
+    //   - auth-service's "OTP expired"
+    //   - any future wording with "expir" or "too long" in it
+    expect(html).toMatch(/var isExpired = \/expir\|too long\/i\.test/)
+  })
+
+  it('renders the inline action with the "Send a new code" label and triggers the Resend button', () => {
+    const html = renderDefault()
+    // The inline action label and the click target must be present.
+    expect(html).toContain("'Send a new code'")
+    expect(html).toContain("document.getElementById('btn-resend').click()")
+  })
+
+  it('falls back to the plain showError on non-expired errors', () => {
+    const html = renderDefault()
+    // The non-expired branch must NOT route through
+    // showErrorWithAction (otherwise an "Invalid code" message
+    // would carry an inappropriate "Send a new code" link).
+    expect(html).toMatch(
+      /if \(isExpired\) \{[\s\S]*?\} else \{[\s\S]*?showError\(result\.error\);\s*\}/,
+    )
+  })
+})
+
+describe('renderLoginPage flow-aborted notice + reactive abort gates', () => {
+  // The proactive notice fires when /auth/ping reports the flow is
+  // unrecoverable (par_expired / flow_expired / no_cookie). It
+  // disables every form control and shows a Start over button that
+  // navigates to /auth/abort. The reactive gates (Resend click,
+  // Verify submit) ping /auth/ping just-in-time and bail to
+  // /auth/abort if the flow is dead — defence in depth on top of
+  // the proactive notice.
+
+  it('inlines /auth/abort as the Start over destination', () => {
+    const html = renderDefault()
+    expect(html).toContain("'/auth/abort'")
+  })
+
+  it('declares showFlowAbortedNotice as idempotent (flowAborted flag)', () => {
+    const html = renderDefault()
+    // The idempotence guard prevents duplicate banners if both the
+    // proactive heartbeat tick AND a reactive gate fire the notice.
+    expect(html).toContain('var flowAborted = false')
+    expect(html).toMatch(
+      /function showFlowAbortedNotice\(\)\s*\{\s*if \(flowAborted\) return;/,
+    )
+  })
+
+  it('disables every form control when the notice fires', () => {
+    const html = renderDefault()
+    const fnStart = html.indexOf('function showFlowAbortedNotice()')
+    expect(fnStart).toBeGreaterThan(0)
+    const fnEnd = html.indexOf('function abortIfFlowDead', fnStart)
+    expect(fnEnd).toBeGreaterThan(fnStart)
+    const fnBody = html.slice(fnStart, fnEnd)
+    // OTP boxes, Resend, Back, and Verify must all get disabled —
+    // anything left enabled would let the user click into a path
+    // that silently fails.
+    expect(fnBody).toMatch(/otpBoxes\[i\]\.disabled = true/)
+    expect(fnBody).toMatch(/resendBtn\.disabled = true/)
+    expect(fnBody).toMatch(/backBtn\.disabled = true/)
+    expect(fnBody).toMatch(/verifyBtn\.disabled = true/)
+  })
+
+  it('renders the Start over button with a textContent label sink', () => {
+    const html = renderDefault()
+    const fnStart = html.indexOf('function showFlowAbortedNotice()')
+    const fnEnd = html.indexOf('function abortIfFlowDead', fnStart)
+    const fnBody = html.slice(fnStart, fnEnd)
+    expect(fnBody).toContain("startOverBtn.textContent = 'Start over'")
+    // No innerHTML — same XSS guard as the inline-action button.
+    expect(fnBody).not.toContain('innerHTML')
+  })
+
+  it('triggers the proactive notice when the heartbeat reports a non-transient ok:false', () => {
+    const html = renderDefault()
+    // The pingHeartbeat handler must call showFlowAbortedNotice
+    // when reason !== 'transient'. Transient failures must not
+    // trigger the notice. Substring-based slicing rather than a
+    // greedy regex (.*?) so Sonar doesn't flag this as ReDoS.
+    const guardIdx = html.indexOf(
+      "if (body && body.ok === false && body.reason !== 'transient')",
+    )
+    expect(guardIdx).toBeGreaterThan(0)
+    // The two effects (stop pinging, show the notice) must both
+    // appear after the guard. Use a bounded slice to keep the
+    // assertion linear.
+    const branchSlice = html.slice(guardIdx, guardIdx + 600)
+    expect(branchSlice).toContain('stopHeartbeat();')
+    expect(branchSlice).toContain('showFlowAbortedNotice();')
+  })
+
+  it('gates the Resend click on abortIfFlowDead', () => {
+    const html = renderDefault()
+    // The Resend click handler must call abortIfFlowDead and
+    // bail if it returns true.
+    const handlerStart = html.indexOf("'btn-resend').addEventListener")
+    expect(handlerStart).toBeGreaterThan(0)
+    const handlerEnd = html.indexOf(
+      "'btn-back').addEventListener",
+      handlerStart,
+    )
+    expect(handlerEnd).toBeGreaterThan(handlerStart)
+    const handlerBody = html.slice(handlerStart, handlerEnd)
+    expect(handlerBody).toMatch(/if \(await abortIfFlowDead\(\)\) return/)
+    // The abort gate must run BEFORE sendOtp — calling sendOtp
+    // first would issue an OTP that cannot be used.
+    const gateIdx = handlerBody.indexOf('abortIfFlowDead')
+    const sendIdx = handlerBody.indexOf('sendOtp(currentEmail)')
+    expect(gateIdx).toBeGreaterThan(0)
+    expect(sendIdx).toBeGreaterThan(gateIdx)
+  })
+
+  it('gates the Verify submit on abortIfFlowDead', () => {
+    const html = renderDefault()
+    // Verify gate runs BEFORE verifyOtp — same reason: don't
+    // consume the OTP if the flow can't complete anyway.
+    const handlerStart = html.indexOf("'form-verify-otp').addEventListener")
+    expect(handlerStart).toBeGreaterThan(0)
+    const handlerEnd = html.indexOf(
+      "'btn-resend').addEventListener",
+      handlerStart,
+    )
+    expect(handlerEnd).toBeGreaterThan(handlerStart)
+    const handlerBody = html.slice(handlerStart, handlerEnd)
+    expect(handlerBody).toMatch(/if \(await abortIfFlowDead\(\)\) return/)
+    const gateIdx = handlerBody.indexOf('abortIfFlowDead')
+    const verifyIdx = handlerBody.indexOf('verifyOtp(currentEmail, otp)')
+    expect(gateIdx).toBeGreaterThan(0)
+    expect(verifyIdx).toBeGreaterThan(gateIdx)
+  })
+})
diff --git a/packages/auth-service/src/__tests__/redirect-to-client-error.test.ts b/packages/auth-service/src/__tests__/redirect-to-client-error.test.ts
new file mode 100644
index 00000000..d0a59a06
--- /dev/null
+++ b/packages/auth-service/src/__tests__/redirect-to-client-error.test.ts
@@ -0,0 +1,191 @@
+/**
+ * Tests for buildClientErrorRedirect — the auth-service helper that
+ * resolves an OAuth client's published metadata and constructs an
+ * RFC 6749 §4.1.2.1 error redirect URL pointing at redirect_uris[0].
+ *
+ * Drives every branch (happy redirect, missing metadata, no
+ * redirect_uris, unparseable URL, non-http(s) scheme) by mocking
+ * resolveClientMetadata at the module boundary.
+ */
+import {
+  describe,
+  it,
+  expect,
+  vi,
+  beforeEach,
+  beforeAll,
+  afterAll,
+} from 'vitest'
+
+const PDS_URL = 'https://pds.example'
+const CLIENT_ID = 'https://demo.example/client-metadata.json'
+const REDIRECT_URI = 'https://demo.example/api/oauth/callback'
+
+const ORIGINAL_PDS_URL = process.env.PDS_INTERNAL_URL
+const ORIGINAL_SECRET = process.env.EPDS_INTERNAL_SECRET
+
+beforeAll(() => {
+  // The lib doesn't read these directly, but importing transitively
+  // pulls in modules that do, and an unset `EPDS_INTERNAL_SECRET`
+  // would crash a sibling import.
+  process.env.PDS_INTERNAL_URL = 'https://core:3000'
+  process.env.EPDS_INTERNAL_SECRET = 'test-secret'
+})
+
+afterAll(() => {
+  if (ORIGINAL_PDS_URL === undefined) delete process.env.PDS_INTERNAL_URL
+  else process.env.PDS_INTERNAL_URL = ORIGINAL_PDS_URL
+  if (ORIGINAL_SECRET === undefined) delete process.env.EPDS_INTERNAL_SECRET
+  else process.env.EPDS_INTERNAL_SECRET = ORIGINAL_SECRET
+})
+
+const resolveClientMetadataMock = vi.hoisted(() => vi.fn())
+vi.mock('@certified-app/shared', async (importActual) => {
+  const actual = await importActual<Record<string, unknown>>()
+  return {
+    ...actual,
+    resolveClientMetadata: resolveClientMetadataMock,
+  }
+})
+
+import { buildClientErrorRedirect } from '../lib/redirect-to-client-error.js'
+
+beforeEach(() => {
+  resolveClientMetadataMock.mockReset()
+})
+
+describe('buildClientErrorRedirect', () => {
+  it('builds a redirect URL with all RFC 6749 §4.1.2.1 query params on the happy path', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: [REDIRECT_URI],
+    })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'Sign-in took too long.',
+    })
+    expect(target).not.toBeNull()
+    const url = new URL(target!)
+    expect(url.origin + url.pathname).toBe(REDIRECT_URI)
+    expect(url.searchParams.get('error')).toBe('access_denied')
+    expect(url.searchParams.get('error_description')).toBe(
+      'Sign-in took too long.',
+    )
+    expect(url.searchParams.get('iss')).toBe(PDS_URL)
+    expect(url.searchParams.has('state')).toBe(false)
+  })
+
+  it('preserves state when supplied', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: [REDIRECT_URI],
+    })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'server_error',
+      description: 'Internal error.',
+      state: 'XNMi-ebr4JAUAEWa-52HEA',
+    })
+    const url = new URL(target!)
+    expect(url.searchParams.get('state')).toBe('XNMi-ebr4JAUAEWa-52HEA')
+    expect(url.searchParams.get('error')).toBe('server_error')
+  })
+
+  it('returns null when resolveClientMetadata throws', async () => {
+    resolveClientMetadataMock.mockRejectedValueOnce(
+      new Error('network unreachable'),
+    )
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(target).toBeNull()
+  })
+
+  it('returns null when metadata has no redirect_uris', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({})
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(target).toBeNull()
+  })
+
+  it('returns null when redirect_uris is empty', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({ redirect_uris: [] })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(target).toBeNull()
+  })
+
+  it('returns null when redirect_uris[0] is not a valid URL', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: ['not a url at all'],
+    })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(target).toBeNull()
+  })
+
+  it('rejects a redirect_uris[0] with a non-http(s) scheme', async () => {
+    // Defence in depth — atproto upstream validates redirect_uris at
+    // PAR creation, but the catch path that calls this helper exists
+    // precisely to spare the user a 500. An unhandled `javascript:`
+    // redirect would defeat that purpose.
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: ['javascript:alert(1)'],
+    })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(target).toBeNull()
+  })
+
+  it('accepts http:// (for localhost dev loops)', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: ['http://localhost:3002/api/oauth/callback'],
+    })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    expect(target).not.toBeNull()
+    expect(target!.startsWith('http://localhost:3002/')).toBe(true)
+  })
+
+  it('uses redirect_uris[0] when multiple are registered', async () => {
+    // Documented limitation: the dead-PAR path lost the in-flight choice
+    // of which URI the client used. Pinning [0] is RFC-compliant ("any
+    // registered URI") but loses correlation. See the deferred Copilot
+    // threads on PR #154 for the full rationale.
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: ['https://demo.example/cb-1', 'https://demo.example/cb-2'],
+    })
+    const target = await buildClientErrorRedirect({
+      clientId: CLIENT_ID,
+      pdsUrl: PDS_URL,
+      code: 'access_denied',
+      description: 'd',
+    })
+    const url = new URL(target!)
+    expect(url.pathname).toBe('/cb-1')
+  })
+})
diff --git a/packages/auth-service/src/__tests__/render-error.test.ts b/packages/auth-service/src/__tests__/render-error.test.ts
index 9597698d..57124b0e 100644
--- a/packages/auth-service/src/__tests__/render-error.test.ts
+++ b/packages/auth-service/src/__tests__/render-error.test.ts
@@ -33,4 +33,77 @@ describe('renderError', () => {
     const html = renderError('x')
     expect(html).toMatch(/<style>[\s\S]*\.container[\s\S]*<\/style>/)
   })
+
+  describe('options object form', () => {
+    // The function accepts either a title string (legacy) or an options
+    // object with title / startOverHref / startOverLabel. Both paths are
+    // production callers — exercise them explicitly so a future signature
+    // change can't silently drop one.
+
+    it('accepts an options object with title', () => {
+      const html = renderError('msg', { title: 'Custom' })
+      expect(html).toContain('<title>Custom</title>')
+      expect(html).toContain('<h1>Custom</h1>')
+    })
+
+    it('falls back to "Error" when options has no title', () => {
+      const html = renderError('msg', {})
+      expect(html).toContain('<title>Error</title>')
+    })
+
+    it('renders a Start Over button when startOverHref is set', () => {
+      const html = renderError('msg', {
+        startOverHref: 'https://demo.example/sign-in',
+      })
+      expect(html).toContain('class="start-over"')
+      expect(html).toContain('href="https://demo.example/sign-in"')
+      expect(html).toContain('rel="noopener noreferrer"')
+      // Default label
+      expect(html).toContain('>Start over</a>')
+    })
+
+    it('uses the provided startOverLabel', () => {
+      const html = renderError('msg', {
+        startOverHref: 'https://demo.example/',
+        startOverLabel: 'Return to sign in',
+      })
+      expect(html).toContain('>Return to sign in</a>')
+    })
+
+    it('omits the Start Over button when no href is given', () => {
+      const html = renderError('msg', { title: 'X' })
+      expect(html).not.toContain('class="start-over"')
+    })
+
+    it('rejects a startOverHref with javascript: scheme', () => {
+      // Defence-in-depth: escapeHtml does NOT neutralise javascript:
+      // URLs (no escape-sensitive chars), so the shared renderer must
+      // refuse to inline them. Auth-service inherits that protection
+      // by passing options straight through.
+      const html = renderError('msg', { startOverHref: 'javascript:alert(1)' })
+      expect(html).not.toContain('class="start-over"')
+      expect(html).not.toContain('javascript:')
+    })
+
+    it('rejects a startOverHref with file: scheme', () => {
+      const html = renderError('msg', { startOverHref: 'file:///etc/passwd' })
+      expect(html).not.toContain('class="start-over"')
+      expect(html).not.toContain('file:')
+    })
+
+    it('rejects a malformed startOverHref', () => {
+      const html = renderError('msg', { startOverHref: 'not a url' })
+      expect(html).not.toContain('class="start-over"')
+    })
+
+    it('still escapes HTML in startOverLabel even though the scheme has been validated', () => {
+      const html = renderError('msg', {
+        startOverHref: 'https://demo.example/',
+        startOverLabel: '<script>alert(1)</script>',
+      })
+      expect(html).toContain('class="start-over"')
+      expect(html).not.toContain('<script>alert(1)</script>')
+      expect(html).toContain('&lt;script&gt;alert(1)&lt;/script&gt;')
+    })
+  })
 })
diff --git a/packages/auth-service/src/index.ts b/packages/auth-service/src/index.ts
index b5001cea..fc59cc2c 100644
--- a/packages/auth-service/src/index.ts
+++ b/packages/auth-service/src/index.ts
@@ -15,6 +15,7 @@ import { createAccountLoginRouter } from './routes/account-login.js'
 import { createAccountSettingsRouter } from './routes/account-settings.js'
 import { createCompleteRouter } from './routes/complete.js'
 import { createChooseHandleRouter } from './routes/choose-handle.js'
+import { createHeartbeatRouter } from './routes/heartbeat.js'
 import { createPreviewRouter } from './routes/preview.js'
 import { createPreviewEmailsRouter } from './routes/preview-emails.js'
 import { createRootRouter } from './routes/root.js'
@@ -94,6 +95,7 @@ export function createAuthService(config: AuthServiceConfig): {
   app.use(createAccountSettingsRouter(ctx, betterAuthInstance))
   app.use(createCompleteRouter(ctx, betterAuthInstance))
   app.use(createChooseHandleRouter(ctx, betterAuthInstance))
+  app.use(createHeartbeatRouter(ctx))
   app.use(createPreviewRouter(ctx))
   app.use(createPreviewEmailsRouter(ctx))
 
diff --git a/packages/auth-service/src/lib/clean-exit.ts b/packages/auth-service/src/lib/clean-exit.ts
new file mode 100644
index 00000000..8c11c2c7
--- /dev/null
+++ b/packages/auth-service/src/lib/clean-exit.ts
@@ -0,0 +1,128 @@
+/**
+ * "Clean exit" response helper used by every dead-end path in
+ * auth-service that today renders a static "Session expired" page
+ * with no recovery option. Two tiers, in priority order:
+ *
+ *   1. Redirect the user back to the OAuth client's `redirect_uri`
+ *      with the RFC 6749 §4.1.2.1 error parameters. The client's own
+ *      UI then surfaces a one-click retry. This is the right
+ *      semantics whenever we have a `clientId` in scope.
+ *
+ *   2. When no `clientId` is in scope (the error fired before we
+ *      stashed one on the auth_flow row, or the auth_flow row itself
+ *      is gone), render a styled HTML page with a "Start over"
+ *      button. The button targets the client's `client_uri` when
+ *      available, or — as a last resort — does not appear at all
+ *      and the user is left to navigate manually. We never strand
+ *      the user without explanation.
+ *
+ * See `docs/design/par-expiry-and-clean-exits.md` for the audit of
+ * which call sites use this helper and why.
+ */
+import type { Response } from 'express'
+import { createLogger, resolveStartOverHref } from '@certified-app/shared'
+import {
+  buildClientErrorRedirect,
+  type ClientErrorCode,
+} from './redirect-to-client-error.js'
+import { renderError } from './render-error.js'
+
+const logger = createLogger('auth:clean-exit')
+
+export interface CleanExitOpts {
+  res: Response
+  /**
+   * The OAuth client this flow belongs to, if known. When present,
+   * the helper attempts the RFC 6749 redirect path first.
+   */
+  clientId: string | null | undefined
+  /** PDS issuer URL for the `iss` parameter on the redirect. */
+  pdsUrl: string
+  /**
+   * Spec error code for the redirect path. `access_denied` for
+   * user-paced timeouts (matches the upstream code), `server_error`
+   * for unexpected internal failures.
+   */
+  code: ClientErrorCode
+  /**
+   * Human-readable copy intended for direct display. Used both as
+   * `error_description` on the redirect path and as the body text on
+   * the Start Over page.
+   */
+  description: string
+  /** HTTP status when the Start Over fallback fires. Default 400. */
+  fallbackStatus?: number
+  /**
+   * Original `state` parameter, if it survives the failure path.
+   * Most cluster-A/B sites have lost it (it lived in the dead PAR);
+   * pass it when available.
+   */
+  state?: string
+  /**
+   * Title for the styled HTML fallback page when the redirect path
+   * cannot fire. Default "Sign-in session expired" matches the
+   * common user-paced-timeout case (`code: 'access_denied'`); pass
+   * an explicit title for `server_error` callers where the body
+   * copy describes an internal failure rather than a session
+   * timeout. Mismatched title vs body would otherwise mis-diagnose
+   * the failure for both users and operators.
+   */
+  fallbackTitle?: string
+}
+
+/**
+ * Emit a clean-exit response. Mutates `res` (sends the redirect or
+ * the HTML page) and returns once the response is committed.
+ */
+export async function cleanExit(opts: CleanExitOpts): Promise<void> {
+  const fallbackStatus = opts.fallbackStatus ?? 400
+
+  // Cache-Control: no-store on every clean-exit path — the response
+  // carries per-request error context and a cached copy is at best
+  // misleading on a later attempt.
+  opts.res.setHeader('Cache-Control', 'no-store')
+
+  // Tier 1: redirect to the OAuth client.
+  if (opts.clientId) {
+    const target = await buildClientErrorRedirect({
+      clientId: opts.clientId,
+      pdsUrl: opts.pdsUrl,
+      code: opts.code,
+      description: opts.description,
+      state: opts.state,
+    })
+    if (target) {
+      opts.res.redirect(303, target)
+      return
+    }
+  }
+
+  // Tier 2: styled page with a Start Over link, when we can resolve
+  // the client's home page. The lookup logic lives in
+  // @certified-app/shared so pds-core's HTML fallback uses the same
+  // resolution / sanitisation rules.
+  const startOverHref = opts.clientId
+    ? await resolveStartOverHref(opts.clientId, logger)
+    : null
+
+  // Default title matches the common timeout case; server_error
+  // callers should pass `fallbackTitle: 'Authentication failed'` (or
+  // similar) so the heading isn't a mis-diagnosis when the body
+  // describes an internal failure.
+  const fallbackTitle =
+    opts.fallbackTitle ??
+    (opts.code === 'server_error'
+      ? 'Authentication failed'
+      : 'Sign-in session expired')
+
+  opts.res
+    .status(fallbackStatus)
+    .type('html')
+    .send(
+      renderError(opts.description, {
+        title: fallbackTitle,
+        startOverHref: startOverHref ?? undefined,
+        startOverLabel: 'Return to sign in',
+      }),
+    )
+}
diff --git a/packages/auth-service/src/lib/redirect-to-client-error.ts b/packages/auth-service/src/lib/redirect-to-client-error.ts
new file mode 100644
index 00000000..0ceeae93
--- /dev/null
+++ b/packages/auth-service/src/lib/redirect-to-client-error.ts
@@ -0,0 +1,126 @@
+/**
+ * Build the RFC 6749 §4.1.2.1 error redirect for a clean exit back to
+ * the OAuth client. When something inside auth-service fails after the
+ * upstream PAR row has died (or never existed in scope), the user
+ * should NOT be stranded on a static "session expired" page —
+ * RFC 6749 says we should bounce them to the OAuth client's
+ * `redirect_uri` with `error`, `error_description`, `iss`, and (when
+ * available) `state` query parameters so the client's own UI can
+ * surface a retry that fits the app.
+ *
+ * This helper resolves the client's metadata (independently of any
+ * dead PAR row) to recover `redirect_uris[0]`, then formats the
+ * redirect URL. It returns `null` when the metadata cannot be
+ * resolved or carries no usable redirect URI — callers should fall
+ * back to the styled Start Over page in that case.
+ *
+ * Lives in auth-service rather than `@certified-app/shared` because
+ * pds-core has its own redirect-builder in
+ * `lib/epds-callback-error.ts` that runs after a successful Step 2
+ * `requestManager.get()` (so it has the real PAR's redirect_uri /
+ * state in hand) — using this helper there would be needlessly
+ * lossier.
+ */
+import { createLogger, resolveClientMetadata } from '@certified-app/shared'
+
+const logger = createLogger('auth:redirect-to-client-error')
+
+/**
+ * RFC 6749 §4.1.2.1 error code. Two values are useful in the
+ * dead-PAR / dead-flow context:
+ *   - `access_denied`: the user-paced timeout case. Matches the code
+ *     @atproto/oauth-provider already uses for PAR expiry on its own
+ *     paths and the code already used by pds-core's
+ *     handleCallbackError, so clients see one error code regardless
+ *     of which surface inside ePDS surfaced the timeout.
+ *   - `server_error`: an unexpected internal failure (better-auth
+ *     outage, missing better-auth session, etc.). RFC-compliant for
+ *     5xx-class problems.
+ */
+export type ClientErrorCode = 'access_denied' | 'server_error'
+
+export interface RedirectToClientErrorOpts {
+  clientId: string
+  pdsUrl: string
+  code: ClientErrorCode
+  description: string
+  /**
+   * The original request's `state` parameter, if it survives the
+   * failure path. Most cluster-A/B sites have lost it because
+   * `state` lived in the dead PAR, but include it when available so
+   * the client can correlate the error with its in-flight attempt.
+   */
+  state?: string
+}
+
+/**
+ * Resolve the client's metadata and return an absolute URL to redirect
+ * the user to. Returns null when:
+ *   - metadata resolution fails (network blip, unreachable client,
+ *     etc.); or
+ *   - the metadata declares no usable `redirect_uris[0]`.
+ *
+ * Callers should treat null as "fall back to the static Start Over
+ * page" rather than swallowing it.
+ */
+export async function buildClientErrorRedirect(
+  opts: RedirectToClientErrorOpts,
+): Promise<string | null> {
+  let metadata
+  try {
+    metadata = await resolveClientMetadata(opts.clientId)
+  } catch (err) {
+    logger.warn(
+      { err, clientId: opts.clientId },
+      'redirectToClientError: client metadata fetch failed',
+    )
+    return null
+  }
+
+  const redirectUri = metadata.redirect_uris?.[0]
+  if (!redirectUri) {
+    logger.warn(
+      { clientId: opts.clientId },
+      'redirectToClientError: client metadata has no redirect_uris',
+    )
+    return null
+  }
+
+  let url: URL
+  try {
+    url = new URL(redirectUri)
+  } catch (err) {
+    logger.warn(
+      { err, clientId: opts.clientId, redirectUri },
+      'redirectToClientError: redirect_uri is not a valid URL',
+    )
+    return null
+  }
+
+  // Defence in depth: reject non-web schemes even if the metadata
+  // somehow advertises one. atproto's @atproto/oauth-provider already
+  // validates redirect_uris at PAR creation, so this branch should be
+  // unreachable in practice — but the catch above exists precisely to
+  // spare the user a 500, and an unhandled `javascript:` redirect
+  // would defeat that. RFC 6749 §3.1.2 requires absolute http/https
+  // URIs; `localhost` http is intentionally permitted for the
+  // dev-loop case.
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+    logger.warn(
+      { clientId: opts.clientId, redirectUri, protocol: url.protocol },
+      'redirectToClientError: redirect_uri has unsupported scheme',
+    )
+    return null
+  }
+
+  // OAuth clients can only redirect to a pre-registered URI anyway,
+  // so using the first one is RFC-compliant. The original `state`
+  // is lost on the dead-PAR path — clients treat the response as an
+  // anonymous error and restart, which is the right semantics for
+  // an expiry.
+  url.searchParams.set('error', opts.code)
+  url.searchParams.set('error_description', opts.description)
+  url.searchParams.set('iss', opts.pdsUrl)
+  if (opts.state) url.searchParams.set('state', opts.state)
+  return url.toString()
+}
diff --git a/packages/auth-service/src/lib/render-error.ts b/packages/auth-service/src/lib/render-error.ts
index 8196d8b6..651fa351 100644
--- a/packages/auth-service/src/lib/render-error.ts
+++ b/packages/auth-service/src/lib/render-error.ts
@@ -1,17 +1,45 @@
 import { renderError as renderSharedError } from '@certified-app/shared'
 import { POWERED_BY_CSS, POWERED_BY_HTML } from './page-helpers.js'
 
+export interface AuthRenderErrorOptions {
+  title?: string
+  /**
+   * Optional URL for a "Start over" button rendered below the error
+   * message. Pass when the OAuth flow has failed in a way the user
+   * cannot recover from automatically and we have a concrete sign-in
+   * page to send them to. See `lib/redirect-to-client-error.ts` for
+   * the typical caller pattern.
+   */
+  startOverHref?: string
+  /** Label for the start-over button. Defaults to "Start over". */
+  startOverLabel?: string
+}
+
 /**
  * Auth-service's error page reuses `@certified-app/shared`'s styled
  * `renderError` and adds the auth-service-specific "Powered by
  * Certified" footer below the error card. Pds-core uses the shared
  * version directly (no footer) — the brand promo only belongs on
  * sign-in-flow surfaces.
+ *
+ * Backwards-compatible: callers that only pass a message + title
+ * still work; the second arg can also be an options object that
+ * threads `startOverHref` / `startOverLabel` through to the shared
+ * renderer.
  */
-export function renderError(message: string, title = 'Error'): string {
+export function renderError(
+  message: string,
+  titleOrOptions: string | AuthRenderErrorOptions = 'Error',
+): string {
+  const opts: AuthRenderErrorOptions =
+    typeof titleOrOptions === 'string'
+      ? { title: titleOrOptions }
+      : titleOrOptions
   return renderSharedError(message, {
-    title,
+    title: opts.title ?? 'Error',
     extraCss: POWERED_BY_CSS,
     bodyExtra: POWERED_BY_HTML,
+    startOverHref: opts.startOverHref,
+    startOverLabel: opts.startOverLabel,
   })
 }
diff --git a/packages/auth-service/src/routes/choose-handle.ts b/packages/auth-service/src/routes/choose-handle.ts
index fa987463..555a912f 100644
--- a/packages/auth-service/src/routes/choose-handle.ts
+++ b/packages/auth-service/src/routes/choose-handle.ts
@@ -22,13 +22,14 @@ import {
   escapeHtml,
   signCallback,
   validateLocalPart,
+  type CallbackParams,
   type HandleMode,
 } from '@certified-app/shared'
 import { fromNodeHeaders } from 'better-auth/node'
+import { cleanExit } from '../lib/clean-exit.js'
 import { getDidByEmail } from '../lib/get-did-by-email.js'
 import { pingParRequest } from '../lib/ping-par-request.js'
 import { requireInternalEnv } from '../lib/require-internal-env.js'
-import { renderError } from '../lib/render-error.js'
 import { resolveClientBranding } from '../lib/client-metadata.js'
 import {
   renderOptionalStyleTag,
@@ -71,10 +72,16 @@ export function createChooseHandleRouter(
     const flowId = req.cookies[AUTH_FLOW_COOKIE] as string | undefined
     if (!flowId) {
       logger.warn('No epds_auth_flow cookie on choose-handle')
-      res
-        .status(400)
-        .type('html')
-        .send(renderError('Session expired, please start over'))
+      // No clientId in scope; clean-exit falls through to a Start
+      // Over page with no recoverable button.
+      await cleanExit({
+        res,
+        clientId: null,
+        pdsUrl,
+        code: 'access_denied',
+        description:
+          'Your sign-in took too long to complete. Please start sign-in again.',
+      })
       return null
     }
 
@@ -83,10 +90,14 @@ export function createChooseHandleRouter(
     if (!flow) {
       logger.warn({ flowId }, 'auth_flow not found or expired on choose-handle')
       res.clearCookie(AUTH_FLOW_COOKIE)
-      res
-        .status(400)
-        .type('html')
-        .send(renderError('Session expired, please start over'))
+      await cleanExit({
+        res,
+        clientId: null,
+        pdsUrl,
+        code: 'access_denied',
+        description:
+          'Your sign-in took too long to complete. Please start sign-in again.',
+      })
       return null
     }
 
@@ -102,19 +113,34 @@ export function createChooseHandleRouter(
         { err },
         'Failed to get better-auth session on choose-handle',
       )
-      res
-        .status(500)
-        .type('html')
-        .send(renderError('Authentication failed. Please try again.'))
+      // Internal failure — flow.clientId is in scope so we can
+      // bounce back to the OAuth client with server_error.
+      await cleanExit({
+        res,
+        clientId: flow.clientId,
+        pdsUrl,
+        code: 'server_error',
+        description:
+          'Authentication failed because of a server error. Please try again.',
+        fallbackStatus: 500,
+      })
       return null
     }
 
     if (!session?.user?.email) {
       logger.warn({ flowId }, 'No authenticated session on choose-handle')
-      res
-        .status(401)
-        .type('html')
-        .send(renderError('Session expired, please start over'))
+      // The flow row is still alive so we have a clientId to bounce
+      // back to. User-paced timeout (most likely cause: better-auth
+      // session expired while user was on the picker), not server fault.
+      await cleanExit({
+        res,
+        clientId: flow.clientId,
+        pdsUrl,
+        code: 'access_denied',
+        description:
+          'Your sign-in took too long to complete. Please start sign-in again.',
+        fallbackStatus: 401,
+      })
       return null
     }
 
@@ -169,10 +195,16 @@ export function createChooseHandleRouter(
         },
         'Failed to extend request_uri on choose-handle',
       )
-      res
-        .status(400)
-        .type('html')
-        .send(renderError('Session expired, please start over'))
+      // Cluster B: PAR died before the user even saw the picker.
+      // We have flow.clientId, so bounce them back to the OAuth client.
+      await cleanExit({
+        res,
+        clientId: result.flow.clientId,
+        pdsUrl,
+        code: 'access_denied',
+        description:
+          'Your sign-in took too long to complete. Please start sign-in again.',
+      })
       return
     }
 
@@ -254,10 +286,16 @@ export function createChooseHandleRouter(
         { status: ping.status, err: ping.err, requestUri: flow.requestUri },
         'Failed to extend request_uri on POST choose-handle',
       )
-      res
-        .status(400)
-        .type('html')
-        .send(renderError('Session expired, please start over'))
+      // Cluster B: PAR died while user was picking a handle. We have
+      // flow.clientId, so bounce them back to the OAuth client.
+      await cleanExit({
+        res,
+        clientId: flow.clientId,
+        pdsUrl,
+        code: 'access_denied',
+        description:
+          'Your sign-in took too long to complete. Please start sign-in again.',
+      })
       return
     }
 
@@ -356,13 +394,18 @@ export function createChooseHandleRouter(
     // Step 5: Sign callback with handle local part included in HMAC payload.
     // Only the local part (e.g. 'alice') is sent — pds-core appends its own
     // trusted handleDomain, eliminating any possibility of domain mismatch.
-    const callbackParams = {
+    // client_id is included so pds-core's catch block can mount a
+    // clean-exit redirect to the OAuth client when Step 2's PAR
+    // requestManager.get() throws. See complete.ts for the same
+    // pattern on the no-handle-picker paths.
+    const callbackParams: CallbackParams = {
       request_uri: flow.requestUri,
       email,
       approved: '1',
       new_account: '1',
       handle: normalizedLocal,
     }
+    if (flow.clientId) callbackParams.client_id = flow.clientId
     const { sig, ts } = signCallback(
       callbackParams,
       ctx.config.epdsCallbackSecret,
diff --git a/packages/auth-service/src/routes/complete.ts b/packages/auth-service/src/routes/complete.ts
index 7ec7873e..3c9d9cab 100644
--- a/packages/auth-service/src/routes/complete.ts
+++ b/packages/auth-service/src/routes/complete.ts
@@ -23,11 +23,15 @@
  */
 import { Router, type Request, type Response } from 'express'
 import type { AuthServiceContext } from '../context.js'
-import { createLogger, signCallback } from '@certified-app/shared'
+import {
+  createLogger,
+  signCallback,
+  type CallbackParams,
+} from '@certified-app/shared'
 import { fromNodeHeaders } from 'better-auth/node'
+import { cleanExit } from '../lib/clean-exit.js'
 import { getDidByEmail } from '../lib/get-did-by-email.js'
 import { pingParRequest } from '../lib/ping-par-request.js'
-import { renderError } from '../lib/render-error.js'
 import { requireInternalEnv } from '../lib/require-internal-env.js'
 import { resolveRecoveryEmail } from '../lib/resolve-recovery-email.js'
 
@@ -35,6 +39,47 @@ const logger = createLogger('auth:complete')
 
 const AUTH_FLOW_COOKIE = 'epds_auth_flow'
 
+/**
+ * Build the HMAC-signed `/oauth/epds-callback` redirect URL the
+ * /auth/complete route emits to bridge the user from auth-service to
+ * pds-core once the OTP / handle steps are done. Carries `client_id`
+ * alongside the rest of the signed params so pds-core's catch block
+ * can mount a clean-exit redirect to the client even when the PAR
+ * row has died and Step 2 itself throws (the row is gone before its
+ * `.parameters.client_id` can be read). client_id is signed too, so
+ * an attacker cannot tamper to redirect at a different client.
+ *
+ * `handle` is intentionally omitted on the random-mode path: an
+ * absent `handle` in the signed payload (serialised as '' by
+ * signCallback's `?? ''` sentinel) is the agreed signal to pds-core
+ * that it should call generateRandomHandle() instead of using a
+ * caller-supplied value. Both signCallback and verifyCallback use
+ * the same `params.handle ?? ''` shape; the sentinel is pinned by
+ * tests in packages/shared/src/__tests__/crypto.test.ts.
+ *
+ * Exported so it can be unit-tested without standing up the full
+ * /auth/complete route.
+ */
+export function buildEpdsCallbackUrl(args: {
+  flowRequestUri: string
+  flowClientId: string | null
+  email: string
+  isNewAccount: boolean
+  pdsPublicUrl: string
+  epdsCallbackSecret: string
+}): string {
+  const callbackParams: CallbackParams = {
+    request_uri: args.flowRequestUri,
+    email: args.email,
+    approved: '1',
+    new_account: args.isNewAccount ? '1' : '0',
+  }
+  if (args.flowClientId) callbackParams.client_id = args.flowClientId
+  const { sig, ts } = signCallback(callbackParams, args.epdsCallbackSecret)
+  const params = new URLSearchParams({ ...callbackParams, ts, sig })
+  return `${args.pdsPublicUrl}/oauth/epds-callback?${params.toString()}`
+}
+
 export function createCompleteRouter(
   ctx: AuthServiceContext,
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- better-auth instance has no exported type
@@ -44,15 +89,80 @@ export function createCompleteRouter(
 
   const { pdsUrl, internalSecret } = requireInternalEnv()
 
+  /**
+   * Clean-exit shorthands for the three cleanExit() shapes this route
+   * uses. Lifted out of the handler to keep its branch density below
+   * Sonar's cognitive-complexity gate; the bodies are still trivial
+   * enough to inline-read at the call sites.
+   */
+  const exitWithSignInTimeout = (res: Response): Promise<void> =>
+    cleanExit({
+      res,
+      clientId: null,
+      pdsUrl,
+      code: 'access_denied',
+      description:
+        'Your sign-in took too long to complete. Please start sign-in again.',
+    })
+
+  const exitWithServerError = (
+    res: Response,
+    clientId: string | null,
+  ): Promise<void> =>
+    cleanExit({
+      res,
+      clientId,
+      pdsUrl,
+      code: 'server_error',
+      description:
+        'Authentication failed because of a server error. Please try again.',
+      fallbackStatus: 500,
+    })
+
+  /**
+   * New-user random-mode bridge: skip the handle picker, ping the
+   * PAR to reset the inactivity timer (non-fatal — pds-core will
+   * surface any expiry it sees), and redirect to /oauth/epds-callback.
+   * Lifted out of the handler to keep its branch count down.
+   */
+  async function redirectNewUserRandomMode(
+    res: Response,
+    flow: { requestUri: string; clientId: string | null },
+    email: string,
+    flowId: string,
+  ): Promise<void> {
+    const ping = await pingParRequest(flow.requestUri, pdsUrl, internalSecret)
+    if (!ping.ok) {
+      logger.warn(
+        { status: ping.status, err: ping.err, requestUri: flow.requestUri },
+        'PAR ping returned non-OK on random mode complete — proceeding anyway',
+      )
+    }
+    const url = buildEpdsCallbackUrl({
+      flowRequestUri: flow.requestUri,
+      flowClientId: flow.clientId,
+      email,
+      isNewAccount: true,
+      pdsPublicUrl: ctx.config.pdsPublicUrl,
+      epdsCallbackSecret: ctx.config.epdsCallbackSecret,
+    })
+    logger.info(
+      { email, flowId },
+      'New user (random mode): skipping handle picker, redirecting to epds-callback',
+    )
+    res.redirect(303, url)
+  }
+
   router.get('/auth/complete', async (req: Request, res: Response) => {
     // Step 1: Get flow_id from cookie
     const flowId = req.cookies[AUTH_FLOW_COOKIE] as string | undefined
     if (!flowId) {
       logger.warn('No epds_auth_flow cookie found on /auth/complete')
-      res
-        .status(400)
-        .type('html')
-        .send(renderError('Authentication session expired. Please try again.'))
+      // No clientId in scope (no cookie → no flow → no client), so the
+      // helper falls through to the styled Start Over page with no
+      // button. The user has no recoverable context here; this is the
+      // best we can do.
+      await exitWithSignInTimeout(res)
       return
     }
 
@@ -61,10 +171,7 @@ export function createCompleteRouter(
     if (!flow) {
       logger.warn({ flowId }, 'auth_flow not found or expired')
       res.clearCookie(AUTH_FLOW_COOKIE)
-      res
-        .status(400)
-        .type('html')
-        .send(renderError('Authentication session expired. Please try again.'))
+      await exitWithSignInTimeout(res)
       return
     }
 
@@ -77,10 +184,10 @@ export function createCompleteRouter(
       })
     } catch (err) {
       logger.error({ err }, 'Failed to get better-auth session')
-      res
-        .status(500)
-        .type('html')
-        .send(renderError('Authentication failed. Please try again.'))
+      // Internal failure rather than a user-paced timeout — server_error
+      // per RFC 6749 §4.1.2.1. Flow has a clientId so the user gets
+      // bounced cleanly back to the OAuth client.
+      await exitWithServerError(res, flow.clientId)
       return
     }
 
@@ -125,58 +232,15 @@ export function createCompleteRouter(
 
     const isNewAccount = !did
 
-    if (isNewAccount) {
-      if (flow.handleMode === 'random') {
-        // Step 5a (new user, random mode): Skip handle picker — let pds-core generate
-        // a random handle via generateRandomHandle().
-
-        // Ping the PAR to reset the inactivity timer before redirecting.
-        // Non-fatal: if the ping fails we log and proceed with the original
-        // request_uri — pds-core will surface the expiry if it has occurred.
-        const ping = await pingParRequest(
-          flow.requestUri,
-          pdsUrl,
-          internalSecret,
-        )
-        if (!ping.ok) {
-          logger.warn(
-            { status: ping.status, err: ping.err, requestUri: flow.requestUri },
-            'PAR ping returned non-OK on random mode complete — proceeding anyway',
-          )
-        }
-
-        /**  CONTRACT: `handle` is intentionally omitted from callbackParams here.
-         *  Absent `handle` in the signed payload (serialised as '' by signCallback's
-         *  `?? ''` sentinel) is the agreed signal to pds-core that it should call
-         *  generateRandomHandle() instead of using a caller-supplied value.
-         *
-         *  Both signCallback and verifyCallback use the same `params.handle ?? ''`
-         *
-         *  If you ever change this contract, update pds-core/src/index.ts
-         *  and the sentinel tests in packages/shared/src/__tests__/crypto.test.ts.
-         */
-        const callbackParams = {
-          request_uri: flow.requestUri,
-          email,
-          approved: '1',
-          new_account: '1',
-        }
-        const { sig, ts } = signCallback(
-          callbackParams,
-          ctx.config.epdsCallbackSecret,
-        )
-        const params = new URLSearchParams({ ...callbackParams, ts, sig })
-        logger.info(
-          { email, flowId },
-          'New user (random mode): skipping handle picker, redirecting to epds-callback',
-        )
-        res.redirect(
-          303,
-          `${ctx.config.pdsPublicUrl}/oauth/epds-callback?${params.toString()}`,
-        )
-        return
-      }
+    if (isNewAccount && flow.handleMode === 'random') {
+      // Step 5a: skip the handle picker, let pds-core call
+      // generateRandomHandle() (signalled by the absent `handle`
+      // field in the signed callback).
+      await redirectNewUserRandomMode(res, flow, email, flowId)
+      return
+    }
 
+    if (isNewAccount) {
       // Step 5b (new user, picker/picker-with-random/null mode): Redirect to handle picker.
       // Default (null) preserves existing behavior — picker is always shown.
       // Do NOT delete auth_flow or clear cookie here — TTL cleanup handles expiry.
@@ -193,24 +257,16 @@ export function createCompleteRouter(
     // Consent is handled by the stock @atproto/oauth-provider middleware —
     // pds-core's epds-callback redirects through /oauth/authorize which shows
     // the upstream consent UI with actual OAuth scopes if needed.
-
-    // Cleanup: remove auth_flow row and cookie
     ctx.db.deleteAuthFlow(flowId)
     res.clearCookie(AUTH_FLOW_COOKIE)
-
-    const callbackParams = {
-      request_uri: flow.requestUri,
+    const redirectUrl = buildEpdsCallbackUrl({
+      flowRequestUri: flow.requestUri,
+      flowClientId: flow.clientId,
       email,
-      approved: '1',
-      new_account: '0',
-    }
-    const { sig, ts } = signCallback(
-      callbackParams,
-      ctx.config.epdsCallbackSecret,
-    )
-    const params = new URLSearchParams({ ...callbackParams, ts, sig })
-    const redirectUrl = `${ctx.config.pdsPublicUrl}/oauth/epds-callback?${params.toString()}`
-
+      isNewAccount: false,
+      pdsPublicUrl: ctx.config.pdsPublicUrl,
+      epdsCallbackSecret: ctx.config.epdsCallbackSecret,
+    })
     logger.info(
       { email, flowId, isNewAccount },
       'Bridge: redirecting to epds-callback',
diff --git a/packages/auth-service/src/routes/heartbeat.ts b/packages/auth-service/src/routes/heartbeat.ts
new file mode 100644
index 00000000..79811c18
--- /dev/null
+++ b/packages/auth-service/src/routes/heartbeat.ts
@@ -0,0 +1,137 @@
+/**
+ * GET /auth/ping
+ *
+ * Server-mediated heartbeat used by the OTP and recovery forms to slide
+ * the upstream PAR (request_uri) inactivity timer while the user is on
+ * the page. Without this, a user who reads their email for >5 minutes
+ * (atproto's AUTHORIZATION_INACTIVITY_TIMEOUT) trips the dead-PAR path
+ * downstream when they finally submit. See
+ * `docs/design/par-expiry-and-clean-exits.md` for the broader context.
+ *
+ * The browser cannot call pds-core's /_internal/ping-request directly
+ * (that endpoint requires EPDS_INTERNAL_SECRET, which never leaves the
+ * server), so this route reads the user's `epds_auth_flow` cookie,
+ * looks up the auth_flow row, and proxies the existing
+ * `pingParRequest()` call server-side.
+ *
+ * Security boundary: the heartbeat does *not* extend OTP, auth_flow, or
+ * any session — it only refreshes the PAR row's sliding `expiresAt`
+ * field upstream. Bounded by the auth_flow's own 60-min TTL: once the
+ * auth_flow row is gone, the ping returns `flow_expired` and the
+ * browser stops pinging. No new tokens are issued.
+ */
+import { Router, type Request, type Response } from 'express'
+import { createLogger } from '@certified-app/shared'
+import type { AuthServiceContext } from '../context.js'
+import { cleanExit } from '../lib/clean-exit.js'
+import { pingParRequest } from '../lib/ping-par-request.js'
+import { requireInternalEnv } from '../lib/require-internal-env.js'
+
+const logger = createLogger('auth:heartbeat')
+
+const AUTH_FLOW_COOKIE = 'epds_auth_flow'
+
+export type HeartbeatResponse =
+  | { ok: true }
+  | {
+      ok: false
+      reason:
+        | 'no_cookie'
+        | 'flow_expired'
+        | 'par_expired'
+        /**
+         * Transient — pds-core returned a non-OK status that wasn't
+         * 404 (e.g. 5xx, gateway timeout, network blip). The browser
+         * MUST keep heartbeating; the next tick may succeed. Do NOT
+         * treat as terminal.
+         */
+        | 'transient'
+    }
+
+export function createHeartbeatRouter(ctx: AuthServiceContext): Router {
+  const router = Router()
+  const { pdsUrl, internalSecret } = requireInternalEnv()
+
+  router.get('/auth/ping', async (req: Request, res: Response) => {
+    // Cache-Control: no-store so an intermediary doesn't cache one
+    // user's response and serve it to a different in-flight flow.
+    res.setHeader('Cache-Control', 'no-store')
+
+    const flowId = req.cookies[AUTH_FLOW_COOKIE] as string | undefined
+    if (!flowId) {
+      const body: HeartbeatResponse = { ok: false, reason: 'no_cookie' }
+      res.status(200).json(body)
+      return
+    }
+
+    const flow = ctx.db.getAuthFlow(flowId)
+    if (!flow) {
+      const body: HeartbeatResponse = { ok: false, reason: 'flow_expired' }
+      res.status(200).json(body)
+      return
+    }
+
+    const ping = await pingParRequest(flow.requestUri, pdsUrl, internalSecret)
+    if (!ping.ok) {
+      // Only a 404 from pds-core (`request_uri` deleted/unknown) is
+      // terminal — that's `requestManager.get()` having thrown and
+      // swept the row in the same call. Anything else (5xx, network
+      // timeout, no-status thrown error) is transient: a momentary
+      // upstream blip should not stop the browser from polling, or a
+      // single dropped packet during otherwise-healthy operation
+      // would terminate keepalive permanently and re-introduce the
+      // very dead-end the heartbeat exists to prevent.
+      const isTerminal = ping.status === 404
+      logger.debug(
+        { status: ping.status, err: ping.err, flowId, isTerminal },
+        'heartbeat: PAR ping failed',
+      )
+      const body: HeartbeatResponse = isTerminal
+        ? { ok: false, reason: 'par_expired' }
+        : { ok: false, reason: 'transient' }
+      res.status(200).json(body)
+      return
+    }
+
+    const okBody: HeartbeatResponse = { ok: true }
+    res.status(200).json(okBody)
+  })
+
+  /**
+   * GET /auth/abort
+   *
+   * Browser-driven clean exit. The OTP / recovery forms hit this URL
+   * when they know the flow can no longer complete (typically after
+   * /auth/ping returned `par_expired`). The route runs the same
+   * cleanExit() helper as the unrecoverable-error paths in
+   * /auth/complete and /auth/choose-handle: redirect to the OAuth
+   * client's redirect_uri with `error=access_denied` per RFC 6749
+   * §4.1.2.1, or fall back to a styled "Return to sign in" page when
+   * the client is unknown.
+   *
+   * The point: avoid the dishonest cycle where Resend issues a fresh
+   * OTP that cannot complete the flow because the upstream PAR is
+   * dead. Better to bail to the OAuth client immediately than
+   * mislead the user into typing a code that will fail.
+   */
+  router.get('/auth/abort', async (req: Request, res: Response) => {
+    const flowId = req.cookies[AUTH_FLOW_COOKIE] as string | undefined
+    const flow = flowId ? ctx.db.getAuthFlow(flowId) : undefined
+    // Always clear the cookie — the flow is being abandoned.
+    if (flowId) res.clearCookie(AUTH_FLOW_COOKIE)
+    logger.info(
+      { flowId, hasFlow: !!flow, clientId: flow?.clientId ?? null },
+      'auth-abort: clean-exiting per browser request',
+    )
+    await cleanExit({
+      res,
+      clientId: flow?.clientId ?? null,
+      pdsUrl,
+      code: 'access_denied',
+      description:
+        'Your sign-in took too long to complete. Please start sign-in again.',
+    })
+  })
+
+  return router
+}
diff --git a/packages/auth-service/src/routes/login-page.ts b/packages/auth-service/src/routes/login-page.ts
index 53503472..302d8902 100644
--- a/packages/auth-service/src/routes/login-page.ts
+++ b/packages/auth-service/src/routes/login-page.ts
@@ -124,6 +124,37 @@ export function resolveHandleMode(
   return sharedResolveHandleMode(queryParam, clientMeta.epds_handle_mode)
 }
 
+/**
+ * Decide whether to enable the OTP-form / recovery-form heartbeat for
+ * this request. Heartbeat is on by default; the only way to disable it
+ * is to combine `EPDS_TEST_HOOKS=1` (a server-side opt-in already
+ * required for the e2e test-only routes) with `no_heartbeat=1` on the
+ * URL OR in the form body. This lets e2e scenarios prove the
+ * heartbeat is what saves a slow user without removing the heartbeat
+ * in production.
+ *
+ * The body branch matters for the recovery flow: the email-submit
+ * POST to `/auth/recover` strips query params from the subsequent
+ * OTP form re-render, so a recovery scenario that wants to disable
+ * the heartbeat needs to forward the flag as a hidden field on the
+ * email form. The toggle's only consumer today is the
+ * @par-heartbeat e2e scenario which goes through the login page,
+ * not recovery, so the recovery propagation is a future concern —
+ * documented here so that path doesn't surprise a future reader.
+ */
+export function heartbeatEnabledFor(req: Request): boolean {
+  if (process.env.EPDS_TEST_HOOKS !== '1') return true
+  if (req.query.no_heartbeat === '1') return false
+  // Express's body parser populates req.body for
+  // application/x-www-form-urlencoded POSTs. Reading both surfaces
+  // covers the GET-with-query and POST-with-hidden-field cases
+  // symmetrically; the field is treated as a literal '1' switch so
+  // garbage values don't accidentally disable production heartbeat.
+  const body = req.body as { no_heartbeat?: string } | undefined
+  if (body?.no_heartbeat === '1') return false
+  return true
+}
+
 export function createLoginPageRouter(ctx: AuthServiceContext): Router {
   const router = Router()
 
@@ -426,6 +457,7 @@ export function createLoginPageRouter(ctx: AuthServiceContext): Router {
         legalEntityName: ctx.config.legalEntityName,
         otpLength: ctx.config.otpLength,
         otpCharset: ctx.config.otpCharset,
+        heartbeatEnabled: heartbeatEnabledFor(req),
       }),
     )
   })
@@ -452,6 +484,14 @@ export function renderLoginPage(opts: {
   legalEntityName?: string
   otpLength: number
   otpCharset: 'numeric' | 'alphanumeric'
+  /**
+   * When true, the rendered page starts a 3-min `setInterval` that
+   * GETs /auth/ping while the user is on the OTP step, sliding the
+   * upstream PAR's inactivity timer so the user can read their email
+   * without losing the OAuth flow. Disabled only by the
+   * `?no_heartbeat=1` test toggle (see `heartbeatEnabledFor`).
+   */
+  heartbeatEnabled: boolean
 }): string {
   const b = opts.branding
   const appName = b.client_name || opts.clientName || 'Certified'
@@ -587,6 +627,12 @@ export function renderLoginPage(opts: {
     .flash-msg { padding: 12px; border-radius: 10px; margin: 12px 0; font-size: 14px; text-align: center; }
     .flash-msg.error { color: #dc3545; background: #fdf0f0; }
     .flash-msg.success { color: #28a745; background: #f0fff4; }
+    /* Inline action button rendered next to an OTP-expired error so
+       the user doesn't have to hunt for the separate Resend button.
+       Styled as a link rather than a button to make it visually
+       continuous with the message text. */
+    .flash-action { background: none; border: none; padding: 0; font: inherit; color: inherit; text-decoration: underline; cursor: pointer; }
+    .flash-action:hover { text-decoration: none; }
     .step-otp { display: none; }
     .step-otp.active { display: block; }
     .step-email.hidden { display: none; }
@@ -689,6 +735,114 @@ export function renderLoginPage(opts: {
       var otpBoxes = Array.prototype.slice.call(document.querySelectorAll('.otp-box'));
       var hiddenCode = document.getElementById('code');
 
+      // PAR heartbeat — slides the upstream request_uri inactivity
+      // timer (atproto's AUTHORIZATION_INACTIVITY_TIMEOUT, 5 min) so
+      // a user who waits >5 min for the OTP email doesn't trip the
+      // dead-PAR path on submit. Disabled when ?no_heartbeat=1 was
+      // passed on the original /oauth/authorize URL with EPDS_TEST_HOOKS=1.
+      var heartbeatEnabled = ${JSON.stringify(opts.heartbeatEnabled)};
+      var heartbeatHandle = null;
+      var heartbeatIntervalMs = 3 * 60 * 1000;
+      // Set to true the moment we know the flow can no longer
+      // complete (PAR or auth_flow gone). Resend / Verify gates
+      // check this so a click that races the proactive notice
+      // still bails to /auth/abort instead of issuing a fresh OTP
+      // that would only fail.
+      var flowAborted = false;
+      function pingHeartbeat() {
+        return fetch('/auth/ping', { credentials: 'include', cache: 'no-store' })
+          .then(function(r) { return r.json(); })
+          .then(function(body) {
+            if (body && body.ok === false && body.reason !== 'transient') {
+              // Auth flow / PAR genuinely dead — no point pinging again,
+              // and no point letting the user keep typing. 'transient'
+              // (5xx / network blip) does NOT stop the interval; the
+              // next tick may recover.
+              stopHeartbeat();
+              showFlowAbortedNotice();
+            }
+            return body;
+          })
+          .catch(function() { return null; /* network blip — caller may retry */ });
+      }
+      function startHeartbeat() {
+        if (!heartbeatEnabled) return;
+        if (heartbeatHandle !== null) return;
+        heartbeatHandle = setInterval(pingHeartbeat, heartbeatIntervalMs);
+      }
+      function stopHeartbeat() {
+        if (heartbeatHandle !== null) {
+          clearInterval(heartbeatHandle);
+          heartbeatHandle = null;
+        }
+      }
+      window.addEventListener('beforeunload', stopHeartbeat);
+
+      // Show the proactive "this won't work — start over" notice when
+      // the flow is unrecoverable. Disables the OTP boxes, the verify
+      // button, and the resend button so nothing the user types or
+      // clicks on the form can silently fail. Replaces the error
+      // banner content with copy + a single Start over button that
+      // navigates to /auth/abort (which performs the spec-compliant
+      // RFC 6749 §4.1.2.1 redirect to the OAuth client). Idempotent —
+      // safe to call from the heartbeat tick AND from the reactive
+      // gates without duplicating the notice.
+      function showFlowAbortedNotice() {
+        if (flowAborted) return;
+        flowAborted = true;
+        // Disable every form control on the OTP step so nothing the
+        // user does on the form has any effect from here on.
+        for (var i = 0; i < otpBoxes.length; i++) otpBoxes[i].disabled = true;
+        var resendBtn = document.getElementById('btn-resend');
+        if (resendBtn) resendBtn.disabled = true;
+        var backBtn = document.getElementById('btn-back');
+        if (backBtn) backBtn.disabled = true;
+        var verifyBtn = document.querySelector('#form-verify-otp button[type=submit]');
+        if (verifyBtn) verifyBtn.disabled = true;
+        // Render the notice in the existing error banner so the
+        // styling / position is consistent with other errors. The
+        // copy is set via textContent (no HTML), the Start over
+        // button is built imperatively.
+        clearError();
+        showFlash(
+          'Your sign-in has timed out. The code we sent will no longer work. Start sign-in again from the app you came from.',
+          'error',
+        );
+        errorEl.appendChild(document.createElement('br'));
+        var startOverBtn = document.createElement('button');
+        startOverBtn.type = 'button';
+        startOverBtn.className = 'flash-action';
+        startOverBtn.textContent = 'Start over';
+        startOverBtn.addEventListener('click', function() {
+          window.location.href = '/auth/abort';
+        });
+        errorEl.appendChild(startOverBtn);
+      }
+
+      /**
+       * Reactive gate used by the Resend and Verify click handlers.
+       * Pings /auth/ping synchronously; if the result indicates the
+       * flow is no longer recoverable, navigates to /auth/abort and
+       * returns true. Caller should bail (return) when this returns
+       * true, since navigation is already in flight. Returns false
+       * for ok / transient / network errors — those should not block
+       * the action since they may not be terminal.
+       */
+      async function abortIfFlowDead() {
+        if (flowAborted) {
+          window.location.href = '/auth/abort';
+          return true;
+        }
+        try {
+          var body = await pingHeartbeat();
+          if (body && body.ok === false && body.reason !== 'transient') {
+            window.location.href = '/auth/abort';
+            return true;
+          }
+        } catch (e) { /* fall through; treat as transient */ }
+        return false;
+      }
+
       function updateHiddenCode() {
         var v = '';
         for (var i = 0; i < otpBoxes.length; i++) v += otpBoxes[i].value;
@@ -740,6 +894,11 @@ export function renderLoginPage(opts: {
       });
 
       function showFlash(msg, kind) {
+        // Build the message DOM imperatively so showErrorWithAction
+        // can append an inline action (e.g. Resend) without ever
+        // interpolating user-influenced strings as HTML. textContent
+        // is the only sink for the msg argument, which neutralises
+        // any HTML in the better-auth error string.
         errorEl.textContent = msg;
         errorEl.classList.remove('error', 'success');
         errorEl.classList.add(kind);
@@ -749,6 +908,26 @@ export function renderLoginPage(opts: {
       function showError(msg) { showFlash(msg, 'error'); }
       function showSuccess(msg) { showFlash(msg, 'success'); }
 
+      /**
+       * Show an error message with an inline action button (e.g. a
+       * "Send a new code" link rendered next to the OTP-expired
+       * message). The action label is set via textContent so a
+       * reflected error string can never inject HTML; the click
+       * handler runs the supplied callback. When actionLabel is
+       * absent, behaves like showError.
+       */
+      function showErrorWithAction(msg, actionLabel, onClick) {
+        showFlash(msg, 'error');
+        if (!actionLabel || typeof onClick !== 'function') return;
+        errorEl.appendChild(document.createTextNode(' '));
+        var btn = document.createElement('button');
+        btn.type = 'button';
+        btn.className = 'flash-action';
+        btn.textContent = actionLabel;
+        btn.addEventListener('click', onClick);
+        errorEl.appendChild(btn);
+      }
+
       function clearError() {
         errorEl.style.display = 'none';
         errorEl.textContent = '';
@@ -803,6 +982,7 @@ export function renderLoginPage(opts: {
         clearOtpBoxes();
         if (otpBoxes.length) otpBoxes[0].focus();
         clearError();
+        startHeartbeat();
       }
 
       function showEmailStep() {
@@ -811,6 +991,7 @@ export function renderLoginPage(opts: {
         headingEl.textContent = 'Sign in';
         if (termsEl) termsEl.style.display = 'block';
         clearError();
+        stopHeartbeat();
       }
 
       // Send OTP via better-auth
@@ -895,16 +1076,46 @@ export function renderLoginPage(opts: {
         // flashes "Invalid OTP" before the page unloads.
         if (verifying) return;
         verifying = true;
+        // Stop pinging the moment a verify is in flight — the redirect
+        // is imminent and any further heartbeat is wasted.
+        stopHeartbeat();
         clearError();
         var otp = document.getElementById('code').value.trim();
         var btn = this.querySelector('button[type=submit]');
         btn.disabled = true;
         btn.textContent = 'Verifying...';
 
+        // Reactive gate (defence in depth on top of the proactive
+        // notice): if the PAR or auth_flow is already dead by the
+        // time the user submits, don't even attempt the verify —
+        // it would consume the OTP and then the dead-PAR path on
+        // /oauth/epds-callback would bounce the user with
+        // error=access_denied anyway. Cleaner to bail upfront.
+        if (await abortIfFlowDead()) return;
+
         try {
           var result = await verifyOtp(currentEmail, otp);
           if (result && result.error) {
-            showError(result.error);
+            // Inline a "Send a new code" action when the error
+            // indicates the OTP has aged out — too easy to miss the
+            // separate Resend button below the form. The substring
+            // match catches the better-auth wording ("Invalid or
+            // expired code") and the auth-service wording ("OTP
+            // expired") plus generic "expir"/"too long" variants.
+            var isExpired = /expir|too long/i.test(result.error);
+            if (isExpired) {
+              // The inline action triggers the same Resend handler,
+              // which itself runs abortIfFlowDead() before issuing
+              // a new code. So even if the PAR is dead the user
+              // gets the spec-compliant bounce rather than a fresh
+              // OTP that wouldn't work — no need to gate the
+              // action's visibility separately here.
+              showErrorWithAction(result.error, 'Send a new code', function() {
+                document.getElementById('btn-resend').click();
+              });
+            } else {
+              showError(result.error);
+            }
             // Clear the boxes so the user re-enters all 6 digits. Editing
             // a still-full grid would auto-submit on the first keystroke
             // (length stays at 6) and spam the rate limiter.
@@ -918,6 +1129,9 @@ export function renderLoginPage(opts: {
             verifying = false;
             btn.disabled = false;
             btn.textContent = 'Verify';
+            // Verify failed (typo, expired OTP, etc.) — the form is
+            // still live, so resume keeping the PAR alive.
+            startHeartbeat();
           }
         }
       });
@@ -927,6 +1141,11 @@ export function renderLoginPage(opts: {
         clearError();
         this.disabled = true;
         this.textContent = 'Sending...';
+        // Reactive gate (defence in depth on top of the proactive
+        // notice): if the PAR or auth_flow is already dead, don't
+        // issue a fresh OTP — the user would never be able to
+        // submit it. Bounce to /auth/abort instead.
+        if (await abortIfFlowDead()) return;
         var result = await sendOtp(currentEmail);
         this.disabled = false;
         this.textContent = 'Resend code';
@@ -965,6 +1184,9 @@ export function renderLoginPage(opts: {
             }
           });
         }
+        // OTP form is already visible server-side; showOtpStep() never
+        // ran, so kick off the heartbeat ourselves.
+        startHeartbeat();
       }
     })();
   </script>
diff --git a/packages/auth-service/src/routes/preview.ts b/packages/auth-service/src/routes/preview.ts
index 7ac43efd..f9938998 100644
--- a/packages/auth-service/src/routes/preview.ts
+++ b/packages/auth-service/src/routes/preview.ts
@@ -224,6 +224,8 @@ export function createPreviewRouter(ctx: AuthServiceContext): Router {
         legalEntityName: ctx.config.legalEntityName,
         otpLength: ctx.config.otpLength,
         otpCharset: ctx.config.otpCharset,
+        // No real OAuth flow behind a preview, so no PAR to keep alive.
+        heartbeatEnabled: false,
       }),
     )
   })
@@ -252,6 +254,8 @@ export function createPreviewRouter(ctx: AuthServiceContext): Router {
         legalEntityName: ctx.config.legalEntityName,
         otpLength: ctx.config.otpLength,
         otpCharset: ctx.config.otpCharset,
+        // No real OAuth flow behind a preview, so no PAR to keep alive.
+        heartbeatEnabled: false,
       }),
     )
   })
@@ -293,6 +297,10 @@ export function createPreviewRouter(ctx: AuthServiceContext): Router {
         customFaviconUrl: faviconUrl,
         customFaviconUrlDark: faviconUrlDark,
         backUri: FAKE_REQUEST_URI,
+        // No real OAuth flow behind a preview, so the flag is a no-op
+        // — leave it on the production default to keep the preview
+        // visually identical to the real form.
+        heartbeatEnabled: true,
       }),
     )
   })
@@ -312,6 +320,7 @@ export function createPreviewRouter(ctx: AuthServiceContext): Router {
         customFaviconUrl: faviconUrl,
         customFaviconUrlDark: faviconUrlDark,
         backUri: FAKE_REQUEST_URI,
+        heartbeatEnabled: false,
       }),
     )
   })
diff --git a/packages/auth-service/src/routes/recovery.ts b/packages/auth-service/src/routes/recovery.ts
index cee2d34a..ac6ae5df 100644
--- a/packages/auth-service/src/routes/recovery.ts
+++ b/packages/auth-service/src/routes/recovery.ts
@@ -27,6 +27,7 @@ import {
 } from '../lib/page-helpers.js'
 import { renderError } from '../lib/render-error.js'
 import { AUTH_FLOW_COOKIE, AUTH_FLOW_TTL_MS } from '../lib/auth-flow.js'
+import { heartbeatEnabledFor } from './login-page.js'
 
 const logger = createLogger('auth:recovery')
 
@@ -93,6 +94,7 @@ export function createRecoveryRouter(
         customFaviconUrl,
         customFaviconUrlDark,
         backUri,
+        heartbeatEnabled: heartbeatEnabledFor(req),
       }),
     )
   })
@@ -114,6 +116,7 @@ export function createRecoveryRouter(
           customFaviconUrl,
           customFaviconUrlDark,
           backUri,
+          heartbeatEnabled: heartbeatEnabledFor(req),
         }),
       )
       return
@@ -129,6 +132,7 @@ export function createRecoveryRouter(
           customFaviconUrl,
           customFaviconUrlDark,
           backUri,
+          heartbeatEnabled: heartbeatEnabledFor(req),
         }),
       )
       return
@@ -146,13 +150,18 @@ export function createRecoveryRouter(
         if (!flowId || !existingFlow) {
           const { randomBytes } = await import('node:crypto')
           flowId = randomBytes(16).toString('hex')
+          // Recover the original OAuth client_id by looking up the live
+          // auth_flow row keyed by this request_uri (the login page
+          // populated it on the parent flow). Falls back to null when
+          // the parent flow has expired or never existed — the rest of
+          // the clean-exit pipeline already handles a null clientId
+          // gracefully (text-only fallback page), so missing clientId
+          // is graceful degradation rather than a breakage.
+          const parentFlow = ctx.db.getAuthFlowByRequestUri(requestUri)
           ctx.db.createAuthFlow({
             flowId,
             requestUri,
-            // Recovery flows always start with null clientId — the prior OAuth
-            // flow's clientId is not recoverable here since getAuthFlow filters
-            // expired rows and we have no peek accessor.
-            clientId: null,
+            clientId: parentFlow?.clientId ?? null,
             // handleMode omitted — recovery flows don't go through handle assignment
             expiresAt: Date.now() + AUTH_FLOW_TTL_MS,
           })
@@ -181,6 +190,7 @@ export function createRecoveryRouter(
             customFaviconUrl,
             customFaviconUrlDark,
             backUri,
+            heartbeatEnabled: heartbeatEnabledFor(req),
           }),
         )
       } catch (err) {
@@ -197,6 +207,7 @@ export function createRecoveryRouter(
             customFaviconUrl,
             customFaviconUrlDark,
             backUri,
+            heartbeatEnabled: heartbeatEnabledFor(req),
           }),
         )
       }
@@ -213,6 +224,7 @@ export function createRecoveryRouter(
           customFaviconUrl,
           customFaviconUrlDark,
           backUri,
+          heartbeatEnabled: heartbeatEnabledFor(req),
         }),
       )
     }
@@ -275,6 +287,7 @@ export function createRecoveryRouter(
           customFaviconUrl,
           customFaviconUrlDark,
           backUri,
+          heartbeatEnabled: heartbeatEnabledFor(req),
         }),
       )
     }
@@ -291,11 +304,28 @@ export function renderRecoveryForm(opts: {
   customFaviconUrl?: string | null
   customFaviconUrlDark?: string | null
   backUri?: string | null
+  /**
+   * Forwarded test-only flag: when the request's heartbeat was
+   * disabled via `?no_heartbeat=1` (gated by `EPDS_TEST_HOOKS=1`),
+   * propagate it as a hidden field so the OTP-form re-render after
+   * the email submit still sees it. Production callers leave this
+   * undefined; the field is only emitted when the flag was actually
+   * set, so this stays a no-op outside tests.
+   */
+  heartbeatEnabled?: boolean
 }): string {
   const requestUriForBack = opts.backUri ?? opts.requestUri
   const backHref = requestUriForBack
     ? `/oauth/authorize?request_uri=${encodeURIComponent(requestUriForBack)}`
     : '/oauth/authorize'
+  // Only emit the hidden field when heartbeat is explicitly OFF — the
+  // field is functionless in production and would just clutter the
+  // form. heartbeatEnabledFor() reads body.no_heartbeat === '1' so
+  // the field carries the literal '1' to disable.
+  const noHeartbeatField =
+    opts.heartbeatEnabled === false
+      ? '<input type="hidden" name="no_heartbeat" value="1">'
+      : ''
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -314,6 +344,7 @@ export function renderRecoveryForm(opts: {
       <form method="POST" action="/auth/recover">
         <input type="hidden" name="csrf" value="${escapeHtml(opts.csrfToken)}">
         <input type="hidden" name="request_uri" value="${escapeHtml(opts.requestUri)}">
+        ${noHeartbeatField}
         <div class="field">
           <label for="email">Backup email address</label>
           <input type="email" id="email" name="email" required autofocus
@@ -325,6 +356,33 @@ export function renderRecoveryForm(opts: {
     </div>
     ${POWERED_BY_HTML}
   </div>
+  <script>
+    (function() {
+      // PAR heartbeat for the email-input recovery page — same shape
+      // as the OTP form and recovery OTP form. A user who lands on
+      // /auth/recover and then pauses (rummaging for a backup email
+      // address, switching tabs, fishing through a different inbox)
+      // would otherwise let the parent OAuth flow's PAR die before
+      // they even submit the email. Stops on form submit / unload /
+      // when the server reports the auth_flow or PAR is gone.
+      if (!${JSON.stringify(opts.heartbeatEnabled !== false)}) return;
+      var handle = null;
+      function ping() {
+        fetch('/auth/ping', { credentials: 'include', cache: 'no-store' })
+          .then(function(r) { return r.json(); })
+          .then(function(body) {
+            if (body && body.ok === false && body.reason !== 'transient') stop();
+          })
+          .catch(function() {});
+      }
+      function stop() { if (handle !== null) { clearInterval(handle); handle = null; } }
+      handle = setInterval(ping, 3 * 60 * 1000);
+      window.addEventListener('beforeunload', stop);
+      Array.prototype.forEach.call(document.querySelectorAll('form'), function(form) {
+        form.addEventListener('submit', stop);
+      });
+    })();
+  </script>
 </body>
 </html>`
 }
@@ -340,6 +398,12 @@ export function renderRecoveryOtpForm(opts: {
   customFaviconUrl?: string | null
   customFaviconUrlDark?: string | null
   backUri?: string | null
+  /**
+   * When true, the page polls /auth/ping every 3 min to slide the
+   * upstream PAR's inactivity timer while the user reads their
+   * recovery email. Mirror of the OTP-form heartbeat in login-page.
+   */
+  heartbeatEnabled: boolean
 }): string {
   const maskedEmail = maskEmail(opts.email)
   const requestUriForBack = opts.backUri ?? opts.requestUri
@@ -347,6 +411,14 @@ export function renderRecoveryOtpForm(opts: {
     ? `/oauth/authorize?request_uri=${encodeURIComponent(requestUriForBack)}`
     : '/oauth/authorize'
   const inputProps = buildOtpInputProps(opts.otpLength, opts.otpCharset)
+  // Forward the heartbeat-disabled flag through Resend (POST
+  // /auth/recover) so the re-rendered OTP form keeps it disabled.
+  // Verify (POST /auth/recover/verify) doesn't re-render this form,
+  // so the flag is irrelevant there. Field is only emitted when
+  // heartbeat is explicitly off — production calls leave it absent.
+  const noHeartbeatField = opts.heartbeatEnabled
+    ? ''
+    : '<input type="hidden" name="no_heartbeat" value="1">'
 
   return `<!DOCTYPE html>
 <html lang="en">
@@ -367,6 +439,7 @@ export function renderRecoveryOtpForm(opts: {
         <input type="hidden" name="csrf" value="${escapeHtml(opts.csrfToken)}">
         <input type="hidden" name="request_uri" value="${escapeHtml(opts.requestUri)}">
         <input type="hidden" name="email" value="${escapeHtml(opts.email)}">
+        ${noHeartbeatField}
         <div class="field">
           <input type="text" id="code" name="code" required autofocus
                  aria-label="One-time code"
@@ -387,12 +460,38 @@ export function renderRecoveryOtpForm(opts: {
         <input type="hidden" name="csrf" value="${escapeHtml(opts.csrfToken)}">
         <input type="hidden" name="request_uri" value="${escapeHtml(opts.requestUri)}">
         <input type="hidden" name="email" value="${escapeHtml(opts.email)}">
+        ${noHeartbeatField}
         <button type="submit" class="btn-secondary">Resend code</button>
       </form>
       <a href="${backHref}" class="btn-secondary">Back to sign in</a>
     </div>
     ${POWERED_BY_HTML}
   </div>
+  <script>
+    (function() {
+      // PAR heartbeat — see packages/auth-service/src/routes/heartbeat.ts.
+      // Mirrors the login-page OTP heartbeat. Stops on form submit /
+      // unload / when the server reports the auth_flow or PAR is gone.
+      if (!${JSON.stringify(opts.heartbeatEnabled)}) return;
+      var handle = null;
+      function ping() {
+        fetch('/auth/ping', { credentials: 'include', cache: 'no-store' })
+          .then(function(r) { return r.json(); })
+          .then(function(body) {
+            // Only terminal reasons stop the loop; 'transient' (5xx /
+            // network blip) keeps polling so the next tick recovers.
+            if (body && body.ok === false && body.reason !== 'transient') stop();
+          })
+          .catch(function() {});
+      }
+      function stop() { if (handle !== null) { clearInterval(handle); handle = null; } }
+      handle = setInterval(ping, 3 * 60 * 1000);
+      window.addEventListener('beforeunload', stop);
+      Array.prototype.forEach.call(document.querySelectorAll('form'), function(form) {
+        form.addEventListener('submit', stop);
+      });
+    })();
+  </script>
 </body>
 </html>`
 }
diff --git a/packages/demo/.env.example b/packages/demo/.env.example
index 9914459d..040d26f4 100644
--- a/packages/demo/.env.example
+++ b/packages/demo/.env.example
@@ -49,13 +49,16 @@ AUTH_ENDPOINT=https://auth.pds.example/oauth/authorize
 # auth-service then renders its default Certified styling. Available
 # presets: ocean, amber.
 #
-# Required (uncomment) to run the client-branding e2e feature locally
-# (see features/client-branding.feature): the suite asserts that
-# auth-service inlines the demo's branding CSS, which only happens
-# when client-metadata.json advertises one. Without it, the scenarios
-# in that feature file fail with playwright errors containing
-# `Expected substring: "body { background: #1a1208"`.
-# EPDS_CLIENT_THEME=amber
+# Set by default to `amber` so the @client-branding e2e scenarios
+# pass against a fresh local docker-compose stack without any
+# manual config — the suite asserts auth-service inlines the demo's
+# branding CSS, which only happens when client-metadata.json
+# advertises one. Without a theme, the scenarios in
+# features/client-branding.feature fail with playwright errors
+# containing `Expected substring: "body { background: #1a1208"`
+# (the amber palette's bg). Operators running their own deployment
+# can change to `ocean` or set to empty to disable branding entirely.
+EPDS_CLIENT_THEME=amber
 
 # Session signing secret (generate with: openssl rand -base64 32)
 # SESSION_SECRET=change-me-in-production
diff --git a/packages/demo/src/app/client-metadata.json/route.ts b/packages/demo/src/app/client-metadata.json/route.ts
index a36dde55..0651af16 100644
--- a/packages/demo/src/app/client-metadata.json/route.ts
+++ b/packages/demo/src/app/client-metadata.json/route.ts
@@ -27,6 +27,16 @@ import { getTheme } from '@/lib/theme'
 
 export const runtime = 'nodejs'
 
+// Force runtime rendering so EPDS_CLIENT_THEME (and the other env-fed
+// metadata fields) are read on each request rather than baked at
+// `next build` time. Without this, the route is statically
+// prerendered against whatever the env was when the docker image
+// was built — typically unset — so the published `brand_color`,
+// `background_color`, and `branding.css` fields stay frozen at the
+// defaults regardless of what the running container's env says.
+// Sibling `page.tsx` carries the same flag for the same reason.
+export const dynamic = 'force-dynamic'
+
 export async function GET() {
   const baseUrl = getBaseUrl()
   const theme = getTheme()
diff --git a/packages/pds-core/src/__tests__/epds-callback-error.test.ts b/packages/pds-core/src/__tests__/epds-callback-error.test.ts
index e8c4fa07..31b88d4c 100644
--- a/packages/pds-core/src/__tests__/epds-callback-error.test.ts
+++ b/packages/pds-core/src/__tests__/epds-callback-error.test.ts
@@ -1,5 +1,22 @@
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it, vi, beforeEach } from 'vitest'
 import type { Response } from 'express'
+
+// Mock `resolveClientMetadata` so the new signedClientId fallback path
+// can drive happy/sad branches without standing up a real client
+// metadata HTTP fetch. The mock is hoisted (vi.mock is statically
+// applied at module-graph time) so it is in effect before the
+// epds-callback-error module is imported below.
+const resolveClientMetadataMock = vi.hoisted(() => vi.fn())
+const resolveStartOverHrefMock = vi.hoisted(() => vi.fn())
+vi.mock('@certified-app/shared', async (importActual) => {
+  const actual = await importActual<Record<string, unknown>>()
+  return {
+    ...actual,
+    resolveClientMetadata: resolveClientMetadataMock,
+    resolveStartOverHref: resolveStartOverHrefMock,
+  }
+})
+
 import {
   EXPIRED_PAR_MESSAGE_PATTERN,
   classifyCallbackError,
@@ -9,6 +26,12 @@ import {
 const PDS_URL = 'https://pds.example'
 const REDIRECT_URI = 'https://demo.example/api/oauth/callback'
 const STATE = 'XNMi-ebr4JAUAEWa-52HEA'
+const CLIENT_ID = 'https://demo.example/client-metadata.json'
+
+beforeEach(() => {
+  resolveClientMetadataMock.mockReset()
+  resolveStartOverHrefMock.mockReset()
+})
 
 const TIMEOUT_DESCRIPTION =
   'Your sign-in took too long to complete and timed out. Please start sign-in again.'
@@ -143,10 +166,11 @@ describe('classifyCallbackError', () => {
  *  override). Returns the inspect snapshot plus the spies, so tests
  *  can assert on response state, the renderError contract, and the
  *  logger contract from one call site. */
-function invoke(opts: {
+async function invoke(opts: {
   err: unknown
   capturedRedirectUri?: string
   capturedState?: string
+  signedClientId?: string
   forceHeadersSent?: boolean
 }) {
   const { res, inspect } = makeResStub()
@@ -155,11 +179,12 @@ function invoke(opts: {
   }
   const renderError = vi.fn((m: string) => `<html>${m}</html>`)
   const logger = { error: vi.fn(), warn: vi.fn() }
-  handleCallbackError({
+  await handleCallbackError({
     res,
     err: opts.err,
     capturedRedirectUri: opts.capturedRedirectUri,
     capturedState: opts.capturedState,
+    signedClientId: opts.signedClientId,
     pdsUrl: PDS_URL,
     logger,
     renderError,
@@ -168,8 +193,8 @@ function invoke(opts: {
 }
 
 describe('handleCallbackError — redirect path', () => {
-  it('redirects with error=access_denied + timeout description on expired PAR', () => {
-    const got = invoke({
+  it('redirects with error=access_denied + timeout description on expired PAR', async () => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
@@ -183,8 +208,8 @@ describe('handleCallbackError — redirect path', () => {
     expect(url.searchParams.get('state')).toBe(STATE)
   })
 
-  it('redirects with error=server_error on unrelated failures', () => {
-    const got = invoke({
+  it('redirects with error=server_error on unrelated failures', async () => {
+    const got = await invoke({
       err: new Error('Database connection refused'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
@@ -196,8 +221,8 @@ describe('handleCallbackError — redirect path', () => {
     expect(url.searchParams.get('state')).toBe(STATE)
   })
 
-  it('omits state when none was captured', () => {
-    const got = invoke({
+  it('omits state when none was captured', async () => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: REDIRECT_URI,
     })
@@ -205,8 +230,8 @@ describe('handleCallbackError — redirect path', () => {
     expect(url.searchParams.has('state')).toBe(false)
   })
 
-  it('issues a 303 See Other so OAuth clients re-fetch with GET', () => {
-    const got = invoke({
+  it('issues a 303 See Other so OAuth clients re-fetch with GET', async () => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
@@ -214,8 +239,8 @@ describe('handleCallbackError — redirect path', () => {
     expect(got.redirectStatus).toBe(303)
   })
 
-  it('marks the redirect non-cacheable so per-request state cannot be replayed', () => {
-    const got = invoke({
+  it('marks the redirect non-cacheable so per-request state cannot be replayed', async () => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
@@ -235,8 +260,8 @@ describe('handleCallbackError — malformed captured redirect_uri', () => {
     '://broken',
     '/relative/only',
     'https://[malformed-bracket',
-  ])('falls back to HTML when capturedRedirectUri is %s', (badUri) => {
-    const got = invoke({
+  ])('falls back to HTML when capturedRedirectUri is %s', async (badUri) => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: badUri,
       capturedState: STATE,
@@ -246,7 +271,10 @@ describe('handleCallbackError — malformed captured redirect_uri', () => {
     // HTML page served instead.
     expect(got.statusCode).toBe(400)
     expect(got.contentType).toBe('html')
-    expect(got.renderError).toHaveBeenCalledWith(TIMEOUT_DESCRIPTION)
+    expect(got.renderError).toHaveBeenCalledWith(
+      TIMEOUT_DESCRIPTION,
+      expect.any(Object),
+    )
     // The URL parse failure must be visible in operational logs.
     expect(got.logger.error).toHaveBeenCalledWith(
       expect.objectContaining({ capturedRedirectUri: badUri }),
@@ -256,34 +284,40 @@ describe('handleCallbackError — malformed captured redirect_uri', () => {
 })
 
 describe('handleCallbackError — HTML fallback path', () => {
-  it('renders a styled HTML page when no redirect_uri was captured (expired)', () => {
-    const got = invoke({ err: new Error('This request has expired') })
+  it('renders a styled HTML page when no redirect_uri was captured (expired)', async () => {
+    const got = await invoke({ err: new Error('This request has expired') })
     expect(got.statusCode).toBe(400)
     expect(got.contentType).toBe('html')
-    expect(got.renderError).toHaveBeenCalledWith(TIMEOUT_DESCRIPTION)
+    expect(got.renderError).toHaveBeenCalledWith(
+      TIMEOUT_DESCRIPTION,
+      expect.any(Object),
+    )
     expect(got.body).toContain(TIMEOUT_DESCRIPTION)
     expect(got.redirectLocation).toBeUndefined()
   })
 
-  it('marks the HTML response non-cacheable', () => {
-    const got = invoke({ err: new Error('This request has expired') })
+  it('marks the HTML response non-cacheable', async () => {
+    const got = await invoke({ err: new Error('This request has expired') })
     expect(got.headers['cache-control']).toBe('no-store')
   })
 
-  it('renders a 500 HTML page on generic server failure with no redirect_uri', () => {
-    const got = invoke({ err: new Error('Database connection refused') })
+  it('renders a 500 HTML page on generic server failure with no redirect_uri', async () => {
+    const got = await invoke({ err: new Error('Database connection refused') })
     expect(got.statusCode).toBe(500)
-    expect(got.renderError).toHaveBeenCalledWith(SERVER_DESCRIPTION)
+    expect(got.renderError).toHaveBeenCalledWith(
+      SERVER_DESCRIPTION,
+      expect.any(Object),
+    )
   })
 
-  it('does NOT leak raw JSON {"error":"Authentication failed"}', () => {
+  it('does NOT leak raw JSON {"error":"Authentication failed"}', async () => {
     // Regression guard against the pre-fix behaviour. The body must
     // not parse as the legacy JSON error shape on either status path.
     for (const err of [
       new Error('This request has expired'),
       new Error('Database connection refused'),
     ]) {
-      const got = invoke({ err })
+      const got = await invoke({ err })
       const body = got.body ?? ''
       expect(body.startsWith('{')).toBe(false)
       expect(body).not.toMatch(/^\s*\{\s*"error"/)
@@ -291,9 +325,180 @@ describe('handleCallbackError — HTML fallback path', () => {
   })
 })
 
+describe('handleCallbackError — signedClientId fallback', () => {
+  // When Step 2 inside /oauth/epds-callback throws, no
+  // capturedRedirectUri / capturedState can be stashed (the PAR row
+  // is gone in the same call that threw). The signed callback URL
+  // carries `client_id` so this branch can resolve the client's
+  // published metadata and recover redirect_uris[0]. State is
+  // unrecoverable and the OAuth spec permits its absence on error.
+
+  it('redirects to redirect_uris[0] when capturedRedirectUri is missing but signedClientId resolves', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: [REDIRECT_URI],
+    })
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(resolveClientMetadataMock).toHaveBeenCalledWith(CLIENT_ID)
+    expect(got.renderError).not.toHaveBeenCalled()
+    const url = new URL(got.redirectLocation!)
+    expect(url.origin + url.pathname).toBe(REDIRECT_URI)
+    expect(url.searchParams.get('error')).toBe('access_denied')
+    expect(url.searchParams.get('error_description')).toBe(TIMEOUT_DESCRIPTION)
+    expect(url.searchParams.get('iss')).toBe(PDS_URL)
+    // No state — the original lived in the dead PAR.
+    expect(url.searchParams.has('state')).toBe(false)
+  })
+
+  it('issues 303 + Cache-Control:no-store on the fallback redirect', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: [REDIRECT_URI],
+    })
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(got.redirectStatus).toBe(303)
+    expect(got.headers['cache-control']).toBe('no-store')
+  })
+
+  it('falls back to HTML when signedClientId resolves but metadata has no redirect_uris', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({})
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(got.redirectLocation).toBeUndefined()
+    expect(got.statusCode).toBe(400)
+    expect(got.contentType).toBe('html')
+    expect(got.renderError).toHaveBeenCalledWith(
+      TIMEOUT_DESCRIPTION,
+      expect.any(Object),
+    )
+    expect(got.logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ signedClientId: CLIENT_ID }),
+      expect.stringContaining('no usable redirect_uris'),
+    )
+  })
+
+  it('falls back to HTML when client metadata lookup throws', async () => {
+    resolveClientMetadataMock.mockRejectedValueOnce(new Error('network blip'))
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(got.redirectLocation).toBeUndefined()
+    expect(got.statusCode).toBe(400)
+    expect(got.contentType).toBe('html')
+    expect(got.logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ signedClientId: CLIENT_ID }),
+      expect.stringContaining('client metadata lookup failed'),
+    )
+  })
+
+  it('falls back to HTML when redirect_uris[0] is not a valid URL', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      redirect_uris: ['not a url at all'],
+    })
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(got.redirectLocation).toBeUndefined()
+    expect(got.statusCode).toBe(400)
+    expect(got.logger.error).toHaveBeenCalledWith(
+      expect.objectContaining({
+        signedClientId: CLIENT_ID,
+        fallbackRedirect: 'not a url at all',
+      }),
+      expect.stringContaining('not a valid URL'),
+    )
+  })
+
+  it('prefers capturedRedirectUri over signedClientId when both are present', async () => {
+    // Belt-and-braces: when Step 2 succeeded we have a real
+    // redirect_uri AND state. Don't override that with the
+    // metadata-resolved fallback (no state, possibly different URI).
+    const got = await invoke({
+      err: new Error('account creation failed'),
+      capturedRedirectUri: REDIRECT_URI,
+      capturedState: STATE,
+      signedClientId: CLIENT_ID,
+    })
+    expect(resolveClientMetadataMock).not.toHaveBeenCalled()
+    const url = new URL(got.redirectLocation!)
+    expect(url.searchParams.get('state')).toBe(STATE)
+  })
+
+  it('does not call resolveClientMetadata when no signedClientId is present', async () => {
+    const got = await invoke({ err: new Error('This request has expired') })
+    expect(resolveClientMetadataMock).not.toHaveBeenCalled()
+    // Falls through to the existing static HTML page.
+    expect(got.statusCode).toBe(400)
+    expect(got.contentType).toBe('html')
+  })
+})
+
+describe('handleCallbackError — HTML fallback Start Over CTA', () => {
+  // When neither tier produces a redirect, the HTML fallback should
+  // still surface a "Return to sign in" button when the shared
+  // resolveStartOverHref resolves to a sign-in entry URL. The
+  // resolver's own behaviour (client_uri / origin / scheme
+  // sanitisation) is owned and tested by
+  // packages/shared/src/__tests__/start-over-href.test.ts;
+  // these tests just verify handleCallbackError trusts the resolver
+  // and threads its result onto the renderError options.
+
+  it('renders a Start Over button when signedClientId resolves to a Start Over href', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({}) // Tier 1b: no redirect_uris → falls through
+    resolveStartOverHrefMock.mockResolvedValueOnce('https://demo.example/')
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(got.statusCode).toBe(400)
+    expect(got.contentType).toBe('html')
+    expect(got.renderError).toHaveBeenCalledWith(
+      TIMEOUT_DESCRIPTION,
+      expect.objectContaining({
+        startOverHref: 'https://demo.example/',
+        startOverLabel: 'Return to sign in',
+      }),
+    )
+    expect(resolveStartOverHrefMock).toHaveBeenCalledWith(
+      CLIENT_ID,
+      expect.any(Object),
+    )
+  })
+
+  it('omits the Start Over button when no signedClientId is in scope', async () => {
+    const got = await invoke({ err: new Error('This request has expired') })
+    expect(resolveStartOverHrefMock).not.toHaveBeenCalled()
+    expect(got.renderError).toHaveBeenCalledWith(
+      TIMEOUT_DESCRIPTION,
+      expect.objectContaining({ startOverHref: undefined }),
+    )
+  })
+
+  it('omits the Start Over button when the resolver returns null', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({}) // Tier 1b
+    resolveStartOverHrefMock.mockResolvedValueOnce(null)
+    const got = await invoke({
+      err: new Error('This request has expired'),
+      signedClientId: CLIENT_ID,
+    })
+    expect(got.renderError).toHaveBeenCalledWith(
+      TIMEOUT_DESCRIPTION,
+      expect.objectContaining({ startOverHref: undefined }),
+    )
+  })
+})
+
 describe('handleCallbackError — already-responded short-circuit', () => {
-  it('does nothing when headers were already sent', () => {
-    const got = invoke({
+  it('does nothing when headers were already sent', async () => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
@@ -310,8 +515,8 @@ describe('handleCallbackError — log levels', () => {
   // fault. They should land at warn so they stay in operational logs
   // but don't trigger error-level alerting once expiry becomes
   // routine in production.
-  it('logs an expired-PAR failure at warn (not error)', () => {
-    const got = invoke({
+  it('logs an expired-PAR failure at warn (not error)', async () => {
+    const got = await invoke({
       err: new Error('This request has expired'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
@@ -323,8 +528,8 @@ describe('handleCallbackError — log levels', () => {
     expect(got.logger.error).not.toHaveBeenCalled()
   })
 
-  it('logs a generic server failure at error (not warn)', () => {
-    const got = invoke({
+  it('logs a generic server failure at error (not warn)', async () => {
+    const got = await invoke({
       err: new Error('Database connection refused'),
       capturedRedirectUri: REDIRECT_URI,
       capturedState: STATE,
diff --git a/packages/pds-core/src/index.ts b/packages/pds-core/src/index.ts
index 49b4e953..bdbe8c71 100644
--- a/packages/pds-core/src/index.ts
+++ b/packages/pds-core/src/index.ts
@@ -204,6 +204,7 @@ async function main() {
     const approvedStr = req.query.approved as string
     const newAccountStr = req.query.new_account as string
     const handleParam = req.query.handle as string | undefined
+    const clientIdParam = req.query.client_id as string | undefined
     const signatureValid = verifyCallback(
       {
         request_uri: requestUri,
@@ -211,6 +212,7 @@ async function main() {
         approved: approvedStr,
         new_account: newAccountStr,
         handle: handleParam,
+        client_id: clientIdParam,
       },
       ts,
       sig,
@@ -602,11 +604,12 @@ async function main() {
         'ePDS callback: redirecting to stock /oauth/authorize for consent/approval',
       )
     } catch (err) {
-      handleCallbackError({
+      await handleCallbackError({
         res,
         err,
         capturedRedirectUri,
         capturedState,
+        signedClientId: clientIdParam,
         pdsUrl,
         logger,
         renderError,
diff --git a/packages/pds-core/src/lib/epds-callback-error.ts b/packages/pds-core/src/lib/epds-callback-error.ts
index 45656035..57f73c81 100644
--- a/packages/pds-core/src/lib/epds-callback-error.ts
+++ b/packages/pds-core/src/lib/epds-callback-error.ts
@@ -26,6 +26,11 @@
  */
 import type { Response } from 'express'
 import type { Logger } from 'pino'
+import {
+  resolveClientMetadata,
+  resolveStartOverHref,
+  type RenderErrorOptions,
+} from '@certified-app/shared'
 
 /** Decoded view of a thrown error for response shaping. */
 export interface CallbackErrorClassification {
@@ -80,21 +85,161 @@ export interface HandleCallbackErrorOpts {
   /** state stashed from Step 2's requestManager.get(); preserved on the
    * redirect for CSRF round-trip. */
   capturedState: string | undefined
+  /**
+   * OAuth client_id, signed and forwarded by auth-service in the
+   * /oauth/epds-callback URL. Used as a last-resort fallback when
+   * `capturedRedirectUri` is absent — the catch block resolves the
+   * client's published metadata to recover `redirect_uris[0]` so the
+   * user can still bounce back to the OAuth client (with `error` and
+   * `error_description`) instead of stranding them on a static page.
+   * The original `state` lives in the dead PAR and is unrecoverable
+   * here; clients treat the missing `state` as an anonymous error.
+   */
+  signedClientId?: string
   /** Issuer identifier per RFC 9207, set on the redirect. */
   pdsUrl: string
   logger: Pick<Logger, 'error' | 'warn'>
   /** Renders the styled HTML fallback page. Injected so tests can
    * assert on the rendered string without pulling in the real
-   * renderer. */
-  renderError: (message: string) => string
+   * renderer. Accepts the same options object the shared
+   * `renderError` exports so the HTML fallback can render a
+   * "Return to sign in" button when we know which OAuth client the
+   * user came from but couldn't construct a valid redirect target
+   * (metadata missing, redirect_uris empty / unparseable). */
+  renderError: (message: string, options?: RenderErrorOptions) => string
 }
 
-export function handleCallbackError(opts: HandleCallbackErrorOpts): void {
+/**
+ * Tier 1a: try to issue an RFC 6749 §4.1.2.1 redirect using the
+ * `redirect_uri` captured from a successful Step-2 read of the
+ * upstream PAR row. Preserves the original `state`. Returns true
+ * when a redirect was emitted; false when `capturedRedirectUri` is
+ * absent or unparseable (caller should fall through to Tier 1b).
+ */
+function tryRedirectFromCapturedUri(args: {
+  res: Response
+  capturedRedirectUri: string | undefined
+  capturedState: string | undefined
+  pdsUrl: string
+  code: 'access_denied' | 'server_error'
+  description: string
+  logger: Pick<Logger, 'error' | 'warn'>
+}): boolean {
+  if (args.res.headersSent || !args.capturedRedirectUri) return false
+  // The redirect_uri was captured from a successful Step-2 read of
+  // the upstream PAR row, and @atproto/oauth-provider validates the
+  // URL at PAR creation, so this is essentially defensive — but the
+  // catch block exists precisely to spare the user a 500. If
+  // `new URL()` ever does throw (upstream invariant changes,
+  // test-only hook injects garbage, etc.), log it and let the caller
+  // fall through to the next tier rather than crashing the error
+  // handler itself.
+  let errorUrl: URL
+  try {
+    errorUrl = new URL(args.capturedRedirectUri)
+  } catch (urlErr) {
+    args.logger.error(
+      { err: urlErr, capturedRedirectUri: args.capturedRedirectUri },
+      'ePDS callback: captured redirect_uri is not a valid URL — falling back to HTML error page',
+    )
+    return false
+  }
+  // Cache-Control: no-store on the redirect so a browser or
+  // intermediary doesn't preserve the per-attempt `state` /
+  // error_description query params (would leak across users on a
+  // shared cache) and doesn't replay a stale 303 on refresh, which
+  // would skip the user past a fresh sign-in attempt.
+  args.res.setHeader('Cache-Control', 'no-store')
+  errorUrl.searchParams.set('error', args.code)
+  errorUrl.searchParams.set('error_description', args.description)
+  errorUrl.searchParams.set('iss', args.pdsUrl)
+  if (args.capturedState) errorUrl.searchParams.set('state', args.capturedState)
+  args.res.redirect(303, errorUrl.toString())
+  return true
+}
+
+/**
+ * Tier 1b: try to issue an RFC 6749 §4.1.2.1 redirect using
+ * `redirect_uris[0]` resolved from the signed `client_id`'s
+ * published OAuth metadata. Used when Step 2 itself threw so we
+ * never captured the PAR's redirect_uri / state.
+ *
+ * RFC 6749 §4.1.2.1 *requires* `state` in the error response when it
+ * was present in the authorization request. We omit it here because
+ * the original `state` value lived in the now-deleted PAR row and
+ * is unrecoverable — this is a pragmatic degradation, not
+ * spec-permitted behaviour. Spec-compliant OAuth clients have to
+ * tolerate uncorrelated error responses anyway (cross-device resume,
+ * browser session loss), so an "anonymous error, restart" outcome
+ * is universally recoverable on the client side. We chose redirect
+ * over stranding on a static page because the user gets back to the
+ * client's UI in either case, and the client at least sees the
+ * specific error code and description.
+ *
+ * `signedClientId` rode along on the HMAC-signed callback URL so a
+ * tampered value cannot redirect a victim's flow at a different
+ * OAuth client. Returns true when a redirect was emitted; false
+ * when no redirect could be constructed (caller should fall through
+ * to the styled HTML page).
+ */
+async function tryRedirectFromSignedClient(args: {
+  res: Response
+  signedClientId: string | undefined
+  pdsUrl: string
+  code: 'access_denied' | 'server_error'
+  description: string
+  logger: Pick<Logger, 'error' | 'warn'>
+}): Promise<boolean> {
+  if (args.res.headersSent || !args.signedClientId) return false
+  let fallbackRedirect: string | undefined
+  try {
+    const metadata = await resolveClientMetadata(args.signedClientId)
+    fallbackRedirect = metadata.redirect_uris?.[0]
+  } catch (lookupErr) {
+    args.logger.warn(
+      { err: lookupErr, signedClientId: args.signedClientId },
+      'ePDS callback: client metadata lookup failed — falling back to HTML error page',
+    )
+    return false
+  }
+  if (!fallbackRedirect) {
+    args.logger.warn(
+      { signedClientId: args.signedClientId },
+      'ePDS callback: client metadata has no usable redirect_uris — falling back to HTML error page',
+    )
+    return false
+  }
+  let errorUrl: URL
+  try {
+    errorUrl = new URL(fallbackRedirect)
+  } catch (urlErr) {
+    args.logger.error(
+      {
+        err: urlErr,
+        signedClientId: args.signedClientId,
+        fallbackRedirect,
+      },
+      'ePDS callback: client metadata redirect_uri is not a valid URL — falling back to HTML error page',
+    )
+    return false
+  }
+  args.res.setHeader('Cache-Control', 'no-store')
+  errorUrl.searchParams.set('error', args.code)
+  errorUrl.searchParams.set('error_description', args.description)
+  errorUrl.searchParams.set('iss', args.pdsUrl)
+  args.res.redirect(303, errorUrl.toString())
+  return true
+}
+
+export async function handleCallbackError(
+  opts: HandleCallbackErrorOpts,
+): Promise<void> {
   const {
     res,
     err,
     capturedRedirectUri,
     capturedState,
+    signedClientId,
     pdsUrl,
     logger,
     renderError,
@@ -113,38 +258,31 @@ export function handleCallbackError(opts: HandleCallbackErrorOpts): void {
     logger.error({ err }, 'ePDS callback error')
   }
 
-  if (!res.headersSent && capturedRedirectUri) {
-    // The redirect_uri was captured from a successful Step-2 read of
-    // the upstream PAR row, and @atproto/oauth-provider validates the
-    // URL at PAR creation, so this is essentially defensive — but the
-    // catch block exists precisely to spare the user a 500. If
-    // `new URL()` ever does throw (upstream invariant changes,
-    // test-only hook injects garbage, etc.), log it and fall through
-    // to the HTML fallback rather than crashing the error handler
-    // itself.
-    let errorUrl: URL | null = null
-    try {
-      errorUrl = new URL(capturedRedirectUri)
-    } catch (urlErr) {
-      logger.error(
-        { err: urlErr, capturedRedirectUri },
-        'ePDS callback: captured redirect_uri is not a valid URL — falling back to HTML error page',
-      )
-    }
-    if (errorUrl) {
-      // Cache-Control: no-store on the redirect so a browser or
-      // intermediary doesn't preserve the per-attempt `state` /
-      // error_description query params (would leak across users on a
-      // shared cache) and doesn't replay a stale 303 on refresh,
-      // which would skip the user past a fresh sign-in attempt.
-      res.setHeader('Cache-Control', 'no-store')
-      errorUrl.searchParams.set('error', code)
-      errorUrl.searchParams.set('error_description', description)
-      errorUrl.searchParams.set('iss', pdsUrl)
-      if (capturedState) errorUrl.searchParams.set('state', capturedState)
-      res.redirect(303, errorUrl.toString())
-      return
-    }
+  if (
+    tryRedirectFromCapturedUri({
+      res,
+      capturedRedirectUri,
+      capturedState,
+      pdsUrl,
+      code,
+      description,
+      logger,
+    })
+  ) {
+    return
+  }
+
+  if (
+    await tryRedirectFromSignedClient({
+      res,
+      signedClientId,
+      pdsUrl,
+      code,
+      description,
+      logger,
+    })
+  ) {
+    return
   }
 
   if (!res.headersSent) {
@@ -152,9 +290,24 @@ export function handleCallbackError(opts: HandleCallbackErrorOpts): void {
     // produced from per-request state, so a cached copy is at best
     // misleading on a later attempt.
     res.setHeader('Cache-Control', 'no-store')
+    // Best-effort Start Over CTA: when we know which OAuth client
+    // initiated the flow (signedClientId), resolve a sign-in entry
+    // URL from its published metadata so the styled fallback isn't
+    // a true dead end. Auth-service does the same thing in
+    // lib/clean-exit.ts. Returns null when no clientId is in scope
+    // or metadata can't be resolved — the page degrades to text-only
+    // in that case.
+    const startOverHref = signedClientId
+      ? await resolveStartOverHref(signedClientId, logger)
+      : null
     res
       .status(isExpired ? 400 : 500)
       .type('html')
-      .send(renderError(description))
+      .send(
+        renderError(description, {
+          startOverHref: startOverHref ?? undefined,
+          startOverLabel: 'Return to sign in',
+        }),
+      )
   }
 }
diff --git a/packages/shared/src/__tests__/crypto.test.ts b/packages/shared/src/__tests__/crypto.test.ts
index d3dba60b..f56a8b65 100644
--- a/packages/shared/src/__tests__/crypto.test.ts
+++ b/packages/shared/src/__tests__/crypto.test.ts
@@ -181,6 +181,7 @@ describe('signCallback / verifyCallback', () => {
       params.approved,
       params.new_account,
       '', // handle sentinel (absent)
+      '', // client_id sentinel (absent)
       staleTs,
     ].join('\n')
     const { createHmac } = await import('node:crypto')
@@ -196,6 +197,7 @@ describe('signCallback / verifyCallback', () => {
       params.approved,
       params.new_account,
       '', // handle sentinel (absent)
+      '', // client_id sentinel (absent)
       futureTs,
     ].join('\n')
     const { createHmac } = await import('node:crypto')
@@ -298,3 +300,74 @@ describe('signCallback / verifyCallback with handle', () => {
     expect(verifyCallback(tamperedParams, ts, sig, secret)).toBe(false)
   })
 })
+
+describe('signCallback / verifyCallback with client_id', () => {
+  const secret = 'test-secret-32bytes-padding-here'
+
+  it('signs and verifies callback with a client_id', () => {
+    const params: CallbackParams = {
+      request_uri: 'urn:ietf:params:oauth:request_uri:test',
+      email: 'alice@example.com',
+      approved: '1',
+      new_account: '0',
+      client_id: 'https://demo.example.com/client-metadata.json',
+    }
+    const { sig, ts } = signCallback(params, secret)
+    expect(verifyCallback(params, ts, sig, secret)).toBe(true)
+  })
+
+  it('rejects tampered client_id (attacker cannot redirect victim flow at a different OAuth client)', () => {
+    const params: CallbackParams = {
+      request_uri: 'urn:ietf:params:oauth:request_uri:test',
+      email: 'alice@example.com',
+      approved: '1',
+      new_account: '0',
+      client_id: 'https://demo.example.com/client-metadata.json',
+    }
+    const { sig, ts } = signCallback(params, secret)
+    const tampered: CallbackParams = {
+      ...params,
+      client_id: 'https://attacker.example.com/client-metadata.json',
+    }
+    expect(verifyCallback(tampered, ts, sig, secret)).toBe(false)
+  })
+
+  it('client_id sentinel: omitting and undefined produce the same signature', () => {
+    // Mirrors the handle sentinel contract — an absent client_id and
+    // an explicit client_id:undefined must both verify against the
+    // same signature, so a caller that forgets to set the field
+    // doesn't accidentally invalidate everything.
+    const baseParams: CallbackParams = {
+      request_uri: 'urn:ietf:params:oauth:request_uri:test',
+      email: 'alice@example.com',
+      approved: '1',
+      new_account: '0',
+    }
+    const withUndefined: CallbackParams = {
+      ...baseParams,
+      client_id: undefined,
+    }
+    const { sig, ts } = signCallback(baseParams, secret)
+    expect(verifyCallback(withUndefined, ts, sig, secret)).toBe(true)
+    const { sig: sig2, ts: ts2 } = signCallback(withUndefined, secret)
+    expect(verifyCallback(baseParams, ts2, sig2, secret)).toBe(true)
+  })
+
+  it('a sig produced WITH a client_id does not verify WITHOUT one', () => {
+    const withClient: CallbackParams = {
+      request_uri: 'urn:ietf:params:oauth:request_uri:test',
+      email: 'alice@example.com',
+      approved: '1',
+      new_account: '0',
+      client_id: 'https://demo.example.com/client-metadata.json',
+    }
+    const { sig, ts } = signCallback(withClient, secret)
+    const withoutClient: CallbackParams = {
+      request_uri: withClient.request_uri,
+      email: withClient.email,
+      approved: withClient.approved,
+      new_account: withClient.new_account,
+    }
+    expect(verifyCallback(withoutClient, ts, sig, secret)).toBe(false)
+  })
+})
diff --git a/packages/shared/src/__tests__/render-error.test.ts b/packages/shared/src/__tests__/render-error.test.ts
new file mode 100644
index 00000000..1b75ddb6
--- /dev/null
+++ b/packages/shared/src/__tests__/render-error.test.ts
@@ -0,0 +1,147 @@
+/**
+ * Tests for the shared `renderError` template. Exercised here from
+ * the source path (`../render-error.js` resolves to
+ * `packages/shared/src/render-error.ts` under vitest's source-tree
+ * coverage instrumentation) — the auth-service / pds-core tests go
+ * through the package's compiled `dist/` and therefore don't count
+ * for shared's coverage. This file is the source of truth for the
+ * template's behaviour.
+ */
+import { describe, it, expect } from 'vitest'
+import { renderError, ERROR_CSS } from '../render-error.js'
+
+describe('renderError — basic shape', () => {
+  it('produces an HTML document with default title', () => {
+    const html = renderError('Something went wrong')
+    expect(html.startsWith('<!DOCTYPE html>')).toBe(true)
+    expect(html).toContain('<title>Error</title>')
+    expect(html).toContain('<h1>Error</h1>')
+    expect(html).toContain('Something went wrong')
+  })
+
+  it('uses the provided title', () => {
+    const html = renderError('Nope', { title: 'Access Denied' })
+    expect(html).toContain('<title>Access Denied</title>')
+    expect(html).toContain('<h1>Access Denied</h1>')
+  })
+
+  it('escapes HTML in the message', () => {
+    const html = renderError('<script>alert(1)</script>')
+    expect(html).not.toContain('<script>alert(1)</script>')
+    expect(html).toContain('&lt;script&gt;alert(1)&lt;/script&gt;')
+  })
+
+  it('escapes HTML in the title', () => {
+    const html = renderError('msg', { title: '<img src=x onerror=alert(1)>' })
+    expect(html).not.toContain('<img src=x onerror=alert(1)>')
+    expect(html).toContain('&lt;img src=x onerror=alert(1)&gt;')
+  })
+
+  it('includes the inline ERROR_CSS', () => {
+    const html = renderError('x')
+    expect(html).toContain(ERROR_CSS)
+  })
+
+  it('appends extraCss after ERROR_CSS', () => {
+    const html = renderError('x', { extraCss: '.custom { color: red }' })
+    expect(html).toContain('.custom { color: red }')
+    expect(html.indexOf(ERROR_CSS)).toBeLessThan(
+      html.indexOf('.custom { color: red }'),
+    )
+  })
+
+  it('inserts bodyExtra after the .container', () => {
+    const html = renderError('x', { bodyExtra: '<footer>powered by</footer>' })
+    expect(html).toContain('<footer>powered by</footer>')
+    // Not inside the .container — comes AFTER it.
+    expect(html.indexOf('</div>')).toBeLessThan(
+      html.indexOf('<footer>powered by</footer>'),
+    )
+  })
+})
+
+describe('renderError — Start Over button', () => {
+  it('renders the button when startOverHref is set', () => {
+    const html = renderError('msg', {
+      startOverHref: 'https://demo.example/sign-in',
+    })
+    expect(html).toContain('class="start-over"')
+    expect(html).toContain('href="https://demo.example/sign-in"')
+    expect(html).toContain('rel="noopener noreferrer"')
+    expect(html).toContain('>Start over</a>')
+  })
+
+  it('uses the provided startOverLabel', () => {
+    const html = renderError('msg', {
+      startOverHref: 'https://demo.example/',
+      startOverLabel: 'Return to sign in',
+    })
+    expect(html).toContain('>Return to sign in</a>')
+  })
+
+  it('omits the button when no href is given', () => {
+    const html = renderError('msg', {})
+    expect(html).not.toContain('class="start-over"')
+  })
+
+  it('omits the button when startOverHref is undefined', () => {
+    const html = renderError('msg', { startOverHref: undefined })
+    expect(html).not.toContain('class="start-over"')
+  })
+
+  it('rejects javascript: scheme', () => {
+    // The whole point of normaliseStartOverHref — escapeHtml does
+    // NOT neutralise `javascript:` URLs because they contain no
+    // escape-sensitive characters, so the renderer must refuse to
+    // inline them at parse time.
+    const html = renderError('msg', { startOverHref: 'javascript:alert(1)' })
+    expect(html).not.toContain('class="start-over"')
+    expect(html).not.toContain('javascript:')
+  })
+
+  it('rejects data: scheme', () => {
+    const html = renderError('msg', {
+      startOverHref: 'data:text/html,<script>alert(1)</script>',
+    })
+    expect(html).not.toContain('class="start-over"')
+  })
+
+  it('rejects file: scheme', () => {
+    const html = renderError('msg', { startOverHref: 'file:///etc/passwd' })
+    expect(html).not.toContain('class="start-over"')
+  })
+
+  it('rejects unparseable URLs', () => {
+    const html = renderError('msg', { startOverHref: 'not a url' })
+    expect(html).not.toContain('class="start-over"')
+  })
+
+  it('accepts http://', () => {
+    const html = renderError('msg', {
+      startOverHref: 'http://localhost:3002/',
+    })
+    expect(html).toContain('href="http://localhost:3002/"')
+  })
+
+  it('escapes HTML in startOverLabel', () => {
+    const html = renderError('msg', {
+      startOverHref: 'https://demo.example/',
+      startOverLabel: '<script>alert(1)</script>',
+    })
+    expect(html).toContain('class="start-over"')
+    expect(html).not.toContain('<script>alert(1)</script>')
+    expect(html).toContain('&lt;script&gt;alert(1)&lt;/script&gt;')
+  })
+
+  it('escapes HTML in startOverHref before inlining (defence in depth)', () => {
+    // A URL like `https://demo.example/?x="><script>alert(1)</script>` is
+    // technically valid (URL constructor accepts it) but the rendered
+    // attribute must not break out into HTML. escapeHtml runs after
+    // normalisation, so the attribute value stays quoted.
+    const html = renderError('msg', {
+      startOverHref: 'https://demo.example/?x=%22%3E%3Cscript%3E',
+    })
+    expect(html).toContain('class="start-over"')
+    expect(html).not.toContain('"><script>')
+  })
+})
diff --git a/packages/shared/src/__tests__/start-over-href.test.ts b/packages/shared/src/__tests__/start-over-href.test.ts
new file mode 100644
index 00000000..3aebbbfd
--- /dev/null
+++ b/packages/shared/src/__tests__/start-over-href.test.ts
@@ -0,0 +1,147 @@
+/**
+ * Tests for the shared `resolveStartOverHref` and `sanitiseHttpUrl`
+ * helpers — the single source of truth used by both auth-service's
+ * `lib/clean-exit.ts` and pds-core's `lib/epds-callback-error.ts`
+ * to populate the "Return to sign in" button on their HTML
+ * fallbacks.
+ *
+ * The auth-service / pds-core tests mock `resolveStartOverHref` at
+ * the package boundary and trust whatever it returns; the shape
+ * tested here (client_uri preference, clientId-origin fallback,
+ * scheme sanitisation, null on metadata throw) is the contract
+ * that justifies that trust.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const resolveClientMetadataMock = vi.hoisted(() => vi.fn())
+vi.mock('../client-metadata.js', () => ({
+  resolveClientMetadata: resolveClientMetadataMock,
+}))
+
+import { resolveStartOverHref, sanitiseHttpUrl } from '../start-over-href.js'
+
+const CLIENT_ID = 'https://demo.example/client-metadata.json'
+
+const silentLogger = {
+  warn: () => {},
+  error: () => {},
+}
+
+beforeEach(() => {
+  resolveClientMetadataMock.mockReset()
+})
+
+describe('sanitiseHttpUrl', () => {
+  it('returns the canonical URL for an https URL', () => {
+    expect(sanitiseHttpUrl('https://demo.example/sign-in')).toBe(
+      'https://demo.example/sign-in',
+    )
+  })
+
+  it('returns the canonical URL for an http URL (dev loops)', () => {
+    expect(sanitiseHttpUrl('http://localhost:3002/')).toBe(
+      'http://localhost:3002/',
+    )
+  })
+
+  it('returns null for null', () => {
+    expect(sanitiseHttpUrl(null)).toBeNull()
+  })
+
+  it('returns null for undefined', () => {
+    expect(sanitiseHttpUrl(undefined)).toBeNull()
+  })
+
+  it('returns null for empty string', () => {
+    expect(sanitiseHttpUrl('')).toBeNull()
+  })
+
+  it('returns null for unparseable strings', () => {
+    expect(sanitiseHttpUrl('not a url')).toBeNull()
+    expect(sanitiseHttpUrl('://broken')).toBeNull()
+  })
+
+  it('rejects javascript: scheme', () => {
+    // The whole reason this helper exists — escapeHtml does NOT
+    // neutralise `javascript:` URLs because they contain no
+    // escape-sensitive characters.
+    expect(sanitiseHttpUrl('javascript:alert(1)')).toBeNull()
+  })
+
+  it('rejects data: scheme', () => {
+    expect(
+      sanitiseHttpUrl('data:text/html,<script>alert(1)</script>'),
+    ).toBeNull()
+  })
+
+  it('rejects file: scheme', () => {
+    expect(sanitiseHttpUrl('file:///etc/passwd')).toBeNull()
+  })
+
+  it('rejects ftp: scheme', () => {
+    expect(sanitiseHttpUrl('ftp://demo.example/')).toBeNull()
+  })
+})
+
+describe('resolveStartOverHref', () => {
+  it('returns metadata.client_uri when present and safe', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      client_uri: 'https://demo.example/sign-in',
+    })
+    const got = await resolveStartOverHref(CLIENT_ID, silentLogger)
+    expect(got).toBe('https://demo.example/sign-in')
+  })
+
+  it('falls back to the clientId origin when client_uri is absent', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({})
+    const got = await resolveStartOverHref(CLIENT_ID, silentLogger)
+    // URL.toString() on a bare-origin URL adds a trailing slash.
+    expect(got).toBe('https://demo.example/')
+  })
+
+  it('falls back to the clientId origin when client_uri is missing entirely', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      client_name: 'Demo',
+    })
+    const got = await resolveStartOverHref(CLIENT_ID, silentLogger)
+    expect(got).toBe('https://demo.example/')
+  })
+
+  it('rejects a javascript: client_uri and falls back to clientId origin', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      client_uri: 'javascript:alert(1)',
+    })
+    const got = await resolveStartOverHref(CLIENT_ID, silentLogger)
+    expect(got).toBe('https://demo.example/')
+  })
+
+  it('rejects an unparseable client_uri and falls back to clientId origin', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({
+      client_uri: 'not a url',
+    })
+    const got = await resolveStartOverHref(CLIENT_ID, silentLogger)
+    expect(got).toBe('https://demo.example/')
+  })
+
+  it('returns null when metadata lookup throws', async () => {
+    resolveClientMetadataMock.mockRejectedValueOnce(new Error('network blip'))
+    const warns: unknown[][] = []
+    const logger = {
+      warn: (...a: unknown[]) => warns.push(a),
+      error: () => {},
+    }
+    const got = await resolveStartOverHref(CLIENT_ID, logger)
+    expect(got).toBeNull()
+    // Failure must be visible in operational logs.
+    expect(warns).toHaveLength(1)
+  })
+
+  it('returns null when both client_uri and clientId origin are unsafe', async () => {
+    resolveClientMetadataMock.mockResolvedValueOnce({})
+    // Use a non-URL clientId so safeOrigin throws and the fallback
+    // sanitises to null. (atproto's upstream wouldn't allow this in
+    // production, but defence in depth.)
+    const got = await resolveStartOverHref('not-a-url', silentLogger)
+    expect(got).toBeNull()
+  })
+})
diff --git a/packages/shared/src/client-metadata.ts b/packages/shared/src/client-metadata.ts
index 9be24bdd..1c3d0ded 100644
--- a/packages/shared/src/client-metadata.ts
+++ b/packages/shared/src/client-metadata.ts
@@ -47,6 +47,14 @@ export interface ClientMetadata {
   brand_color?: string
   background_color?: string
   branding?: ClientBranding
+  /**
+   * The OAuth client's pre-registered redirect URIs. Standard OAuth 2.0
+   * field — the OAuth flow uses redirect_uris[0] when something fails
+   * upstream of the PAR row (so we cannot consult the dead PAR's own
+   * redirect_uri) and we still need to return the user to the client
+   * with an OAuth-spec error per RFC 6749 §4.1.2.1.
+   */
+  redirect_uris?: string[]
   /**
    * ePDS extension — declares the default handle assignment mode for new users.
    * Accepted values: 'random' | 'picker' | 'picker-with-random'.
diff --git a/packages/shared/src/crypto.ts b/packages/shared/src/crypto.ts
index c97b624a..d1a40092 100644
--- a/packages/shared/src/crypto.ts
+++ b/packages/shared/src/crypto.ts
@@ -73,15 +73,16 @@ export interface CallbackParams {
   approved: string
   new_account: string
   handle?: string // only set for new account creation with chosen handle
+  client_id?: string // OAuth client this flow belongs to; carried only so a clean-exit redirect from the catch block on /oauth/epds-callback can recover the client's redirect_uri when the upstream PAR row is gone. Signed so an attacker cannot redirect a victim's flow at a different OAuth client.
 }
 
 /**
  * Sign the epds-callback redirect parameters with HMAC-SHA256.
  * Returns the hex signature and the Unix timestamp (seconds) used.
  *
- * Payload: request_uri, email, approved, new_account, handle (empty string when absent), and ts joined by newlines.
+ * Payload: request_uri, email, approved, new_account, handle (empty when absent), client_id (empty when absent), and ts, joined by newlines.
  * A timestamp is included so signatures expire (see verifyCallback).
- * handle uses empty string as sentinel when absent so existing flows still produce valid signatures.
+ * handle and client_id use empty string as sentinel when absent so existing flows still produce valid signatures and so the payload shape stays stable across releases.
  */
 export function signCallback(
   params: CallbackParams,
@@ -94,6 +95,7 @@ export function signCallback(
     params.approved,
     params.new_account,
     params.handle ?? '', // empty string when absent
+    params.client_id ?? '', // empty string when absent
     ts,
   ].join('\n')
   const sig = crypto.createHmac('sha256', secret).update(payload).digest('hex')
@@ -126,6 +128,7 @@ export function verifyCallback(
     params.approved,
     params.new_account,
     params.handle ?? '', // empty string when absent — matches signCallback sentinel
+    params.client_id ?? '', // empty string when absent — matches signCallback sentinel
     ts,
   ].join('\n')
   const expected = crypto
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index 120fb4f0..f3a0e973 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -79,3 +79,4 @@ export { postHook } from './test-utils/post-hook.js'
 export type { PostHookResult } from './test-utils/post-hook.js'
 export { ERROR_CSS, renderError } from './render-error.js'
 export type { RenderErrorOptions } from './render-error.js'
+export { resolveStartOverHref, sanitiseHttpUrl } from './start-over-href.js'
diff --git a/packages/shared/src/render-error.ts b/packages/shared/src/render-error.ts
index e19c3d4e..22cf2593 100644
--- a/packages/shared/src/render-error.ts
+++ b/packages/shared/src/render-error.ts
@@ -1,5 +1,26 @@
 import { escapeHtml } from './html.js'
 
+/**
+ * Normalise an optional href to a safe absolute URL we are willing to
+ * inline as a button target. Rejects non-`http:`/`https:` schemes so a
+ * caller passing an attacker-controlled `client_uri` cannot end up
+ * rendering `<a href="javascript:...">` into the page (defence in
+ * depth — `escapeHtml` does NOT neutralise `javascript:` URLs because
+ * they contain no escape-sensitive characters). Returns `null` when
+ * the href is missing, unparseable, or carries a disallowed scheme.
+ */
+function normaliseStartOverHref(href?: string): string | null {
+  if (!href) return null
+  let url: URL
+  try {
+    url = new URL(href)
+  } catch {
+    return null
+  }
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') return null
+  return url.toString()
+}
+
 /**
  * CSS shared across every styled error page in the project. Both
  * auth-service and pds-core consume it as-is. Layout is a centred
@@ -16,6 +37,8 @@ export const ERROR_CSS = `
   .container { background: white; border-radius: 12px; padding: 40px; width: 100%; box-shadow: 0 2px 8px rgba(0,0,0,0.08); text-align: center; }
   h1 { font-size: 24px; margin-bottom: 16px; color: #111; }
   .error { color: #dc3545; background: #fdf0f0; padding: 12px; border-radius: 8px; font-size: 15px; line-height: 1.5; }
+  .start-over { display: inline-block; margin-top: 20px; padding: 10px 20px; background: #0f1828; color: white; border-radius: 8px; font-size: 15px; text-decoration: none; }
+  .start-over:hover { background: #1a2a40; }
 `
 
 export interface RenderErrorOptions {
@@ -29,6 +52,19 @@ export interface RenderErrorOptions {
    *  Caller is responsible for ensuring this string is safe HTML —
    *  it is not escaped. */
   bodyExtra?: string
+  /**
+   * Optional "Start over" link rendered as a button below the error
+   * message. When the OAuth flow has failed in a way that cannot be
+   * recovered automatically (no clientId in scope, or the client's
+   * metadata couldn't be resolved), this is the user's escape hatch
+   * back to a fresh sign-in. Provide a fully-qualified URL — typically
+   * the OAuth client's home / sign-in page (`client_uri`) when one is
+   * known, or a bare hostname fallback otherwise. The link is
+   * HTML-escaped; render with rel="noopener noreferrer".
+   */
+  startOverHref?: string
+  /** Visible label for the start-over button. Defaults to "Start over". */
+  startOverLabel?: string
 }
 
 /**
@@ -41,7 +77,17 @@ export function renderError(
   message: string,
   options: RenderErrorOptions = {},
 ): string {
-  const { title = 'Error', extraCss = '', bodyExtra = '' } = options
+  const {
+    title = 'Error',
+    extraCss = '',
+    bodyExtra = '',
+    startOverHref,
+    startOverLabel = 'Start over',
+  } = options
+  const safeStartOverHref = normaliseStartOverHref(startOverHref)
+  const startOverHtml = safeStartOverHref
+    ? `<a class="start-over" href="${escapeHtml(safeStartOverHref)}" rel="noopener noreferrer">${escapeHtml(startOverLabel)}</a>`
+    : ''
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -57,6 +103,7 @@ export function renderError(
     <div class="container">
       <h1>${escapeHtml(title)}</h1>
       <p class="error">${escapeHtml(message)}</p>
+      ${startOverHtml}
     </div>
     ${bodyExtra}
   </div>
diff --git a/packages/shared/src/start-over-href.ts b/packages/shared/src/start-over-href.ts
new file mode 100644
index 00000000..fbd4220d
--- /dev/null
+++ b/packages/shared/src/start-over-href.ts
@@ -0,0 +1,78 @@
+/**
+ * Best-effort lookup of an OAuth client's user-facing sign-in entry
+ * URL. Used by both auth-service's `lib/clean-exit.ts` and pds-core's
+ * `lib/epds-callback-error.ts` to populate the "Return to sign in"
+ * button on their respective HTML fallback pages — a single source
+ * of truth so the two surfaces don't drift.
+ *
+ * Resolution order:
+ *   1. `client_uri` from the client's published OAuth metadata
+ *      (the field is documented for exactly this purpose).
+ *   2. The clientId's own origin, when clientId is a URL (the
+ *      atproto convention is `client_id` is itself an HTTPS URL
+ *      pointing at the metadata document on the client's own host,
+ *      so the origin is a reasonable landing page).
+ *
+ * Returns null when neither resolves to a safe http(s) URL — the
+ * caller should then omit the Start Over button entirely rather
+ * than shipping a broken or unsafe link.
+ *
+ * Defence in depth: every URL we'd inline as the button's `href`
+ * runs through `sanitiseHttpUrl`, which rejects schemes other than
+ * http/https. atproto's upstream OAuth provider already validates
+ * these fields at registration, but the HTML-fallback path exists
+ * precisely to spare the user a 500 — and an unhandled
+ * `javascript:` redirect would defeat that purpose.
+ */
+import type { Logger } from 'pino'
+import { resolveClientMetadata } from './client-metadata.js'
+
+export async function resolveStartOverHref(
+  clientId: string,
+  logger: Pick<Logger, 'error' | 'warn'>,
+): Promise<string | null> {
+  try {
+    const metadata = await resolveClientMetadata(clientId)
+    const fromMetadata = sanitiseHttpUrl(metadata.client_uri)
+    if (fromMetadata) return fromMetadata
+    return sanitiseHttpUrl(safeOrigin(clientId))
+  } catch (err) {
+    logger.warn(
+      { err, clientId },
+      'resolveStartOverHref: client metadata lookup failed',
+    )
+    return null
+  }
+}
+
+/**
+ * Return `value` only when it parses as an absolute http(s) URL;
+ * otherwise null. `escapeHtml` does NOT neutralise `javascript:` URLs
+ * because they contain no escape-sensitive characters, so anything
+ * we plan to inline as an `href` must be scheme-validated up front.
+ *
+ * Exported because `resolveStartOverHref` is the typical caller
+ * shape but a few sites (e.g. callers that already have a metadata
+ * object in hand) want the bare sanitiser.
+ */
+export function sanitiseHttpUrl(
+  value: string | null | undefined,
+): string | null {
+  if (!value) return null
+  let url: URL
+  try {
+    url = new URL(value)
+  } catch {
+    return null
+  }
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') return null
+  return url.toString()
+}
+
+function safeOrigin(value: string): string | null {
+  try {
+    return new URL(value).origin
+  } catch {
+    return null
+  }
+}
diff --git a/vitest.config.ts b/vitest.config.ts
index 17a5fbcd..628296cb 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -23,10 +23,10 @@ export default defineConfig({
       // Ratchet thresholds — update these whenever coverage increases.
       // See AGENTS.md for the ratcheting policy.
       thresholds: {
-        statements: 44,
-        branches: 41,
-        functions: 63,
-        lines: 43,
+        statements: 56,
+        branches: 55,
+        functions: 69,
+        lines: 54,
       },
     },
   },