grim7/14/2026, 2:18:10 AM

The Setup-URL redirect (completeInstallation) is the only path that wrote
user_installations, and it depends on the browser carrying installation_id back
from GitHub through the SPA — which didn't survive in prod, so real installs
synced repos but never linked the user, leaving them stuck before the repo
picker.

Add claimInstallationForForgeUser: on the installation webhook the worker now
matches the payload's actor (installer's GitHub id) to forge_identities and
writes user_installations directly. Durable — no reliance on the redirect. The
Setup-URL callback stays as a fallback. No-op when the installer hasn't signed
in yet (idempotent via the (forge, installationId) unique). Tests cover the
linked and deferred cases.

Parentc027335