apps/api/src/routes/setup.ts

@@ -275,6 +275,9 @@ setupRouter.post('/credential', zValidator('json', credentialSchema, noEchoHook)
     .limit(1);
 
   if (!localUser) {
+    // Clean up the just-inserted user row to avoid an orphaned unclaimed admin
+    // (WR-01: the catch block below does not cover this early-return path).
+    await db.delete(users).where(eq(users.id, inserted.id));
     return c.json({ error: 'Service unavailable' }, 503);
   }