[lilyshen0722]

The catalogue half asks the same question the pod-scoped half asks

V2ConnectorsPage's catalogue branch rendered installation.errorMessage || <generic>, and
InstallableInstallation.errorMessage has two kinds of writer: the reconciler's human-authored
constants (projection missing, install lock expired) and markProjectionFailure, which stores the
projector's own exception text — connect ECONNREFUSED <addr>:443. So a raw exception was printed in a
stranger's connector row: disclosure of internal addresses and stack-adjacent text, not diagnosis.
Measured on main at f5ded480 while fixing the pod-scoped half, and disclosed there rather than folded
in (TASK-131).

React escapes the child, so this is not XSS. It is what the row says about us.

The shape, carried over from #1878

#1878 gave Integration a provenance flag, errorMessageUserFacing, written together with the message
by one owner (connectorDeliveryFailureService). The same pair, for the same reason:

where	what changed
installableInstallationService.ts	userFacingInstallationError(reason) and diagnosticInstallationError(error) — the two ways the field gets a value, so message and flag are written together; markProjectionFailure takes the builder
installableReconciler.ts	both $sets (stale lock, missing projection) take the builder
InstallableInstallation	errorMessageUserFacing Boolean, default false
installableCatalogService.ts	hands the flag over beside the message, so the page never infers provenance from the shape of a string
V2ConnectorsPage.tsx	the catalogue branch gates on errorMessageUserFacing && errorMessage, exactly as the pod-scoped branch already does

a flagged reason (the reconciler's channel-gone sentence) still renders verbatim; connect ECONNREFUSED … does not.

wren 73858's follow-up, in the same PR

externalFeedService's error $set omitted the flag. A $set that omits a key inherits the row's
stored value, so omitting it was only safe on a row that had never carried one — a row already flipped
by a permanent delivery failure kept true, and this writer's provider text would then render under
that earlier provenance. It now states false, and its comment says why instead of claiming the flag
"stays unset". The delivery-failure docstring gains the fallback line: stated, not defaulted.

Reachability, measured by wren at fa04e6ae: the only writer of true runs on the Telegram and Slack
flip paths, which need a bound config.chatId, and no x or instagram row can have one — so this is
contract-tightening, not a live disclosure.

The copy pass, and why it rode this PR (wren 73914, vera 73913/73915)

The mechanism here is what makes two strings user-facing: the page prints errorMessage verbatim
whenever a writer declared it readable, and the only such writers are the reconciler's own constants.
So they were rewritten in this PR rather than shot as-is:

• 'install lock expired' -> "Setup was interrupted before it finished. Try again."
• 'projection missing' -> "This connector's channel is gone. Retry to rebuild it."

The second deviates from wren's 73914 wording, under her own "adjust if a string reads wrong in
context": the generic fallback is "Setup didn't finish.", and a flagged reason that reads as a
variation on it would make two different states look like one — vera 73915's constraint. Both strings
name no internal step, and both are pinned by the writer's own witness, so either moving is a red test.

Evidence (UI hold)

Before/after at 1200 and 390 under docs/design/evidence/, captured with
scripts/ui-evidence-shot.mjs: the after side is this branch, the before side is a2913955 (the base),
same DB, same token, each width captured back to back so the row's relative age line does not differ.
Two rows in one frame carry both flag states: the flagged Slack row prints its reason in both
revisions, and the unflagged Telegram row goes from the raw connect ECONNREFUSED 10.4.4.7:443 to
"Setup didn't finish." The diff of the two innerText dumps is that one line and nothing else; the
.txt pair ships beside the PNGs because the text is the quotable half.

Witnesses

• installableInstallationService.test.js — a real projection failure stores errorMessageUserFacing: false;
  the stale-lock sweep stores true; the missing-projection sweep stores true (both read back from the
  database after a real sweep()).
• installableCatalogService.test.js — the mapper carries true and false through, with the message
  still present both times: the page decides what to show, not the mapper.
• externalFeedService.test.js — the sync-failure $set names the flag beside the status and message.
• V2ConnectorsPage.test.tsx — an unflagged catalogue failure prints the generic sentence and never the
  raw exception; a flagged one prints the message verbatim.

One pre-existing fixture changed, disclosed rather than quietly relaxed: the catalogue Retry test
asserted projection missing verbatim from a fixture with no flag. That fixture now carries the flag its
writer sets — the assertion's intent (a human-authored reason renders) is unchanged, and the two new
witnesses cover both directions.

Ledger (each mutation aimed, each reddening its own witness by name)

mutation	witness that reddened
the catalogue branch renders the field again	TASK-131: a catalog failure prints the generic sentence, not the raw exception that wrote the row
the raw exception is flagged readable	survives repeated component failures and claims the same projection on retry
the stale-lock constant loses its flag	sweeps stale installing and inactive activating rows to error
the projection-missing constant loses its flag	makes a missing active projection a retriable parent error
the mapper drops the provenance it was handed	carries the flag beside the message… (+ the existing catalog DTO test)
the feed writer omits the flag again	marks integration as error when sync fails

Scope and verification

components[].errorMessage is deliberately untouched: the mapper carries it, but no reader renders it
(the page reads component status only), so a flag there would be a contract with no consumer.

One trap worth recording: installableInstallationService.ts ends in a CommonJS module.exports = {…}
tail, which replaces the ES exports — the builders had to be named there too, or every require() of the
module would see them as undefined (found by the first test run, not by reading).

• backend: 60 tests / 5 suites (installation, catalog, feed, installables route, event handlers)
• frontend: 810 tests / 78 suites (src/v2)
• eslint . --ext .ts: 0 errors / 1211 warnings (the base counts)

TASK-131. Gate: @vera.