diff --git a/.maestro/a3_wrong_password.yaml b/.maestro/a3_wrong_password.yaml
index 23912c1..16757d7 100644
--- a/.maestro/a3_wrong_password.yaml
+++ b/.maestro/a3_wrong_password.yaml
@@ -31,15 +31,14 @@ appId: social.coves.dev
     visible: "Wrong identifier or password"
     timeout: 30000
 - assertVisible: "Password"
-# Cancel: the backend currently renders a raw "OAuth callback failed" page in
-# the tab instead of redirecting back to the app (known backend issue), so
-# close the tab manually and confirm the app survived without a crash.
+# Cancel: the backend redirects back to the app with error=access_denied
+# (Coves cc98f26); the app closes the tab and shows a quiet "Sign in
+# cancelled." snackbar on the login screen.
 - tapOn: "Cancel"
 - extendedWaitUntil:
-    visible: "OAuth callback failed.*"
+    visible: "Sign in cancelled.*"
     timeout: 30000
-- tapOn: "Close tab"
 - extendedWaitUntil:
     visible: "Welcome back"
-    timeout: 30000
+    timeout: 15000
 - takeScreenshot: build/maestro/a_wrong_password
diff --git a/.maestro/a4_oauth_cancel.yaml b/.maestro/a4_oauth_cancel.yaml
new file mode 100644
index 0000000..5f0360c
--- /dev/null
+++ b/.maestro/a4_oauth_cancel.yaml
@@ -0,0 +1,57 @@
+# Section A — OAuth cancel handling: denying the authorization request on
+# the PDS consent page redirects back into the app with error=access_denied
+# (Coves backend cc98f26). The app must treat it as a user cancel — no
+# crash, no stuck "signing in" state, a quiet "Sign in cancelled." snackbar
+# on the login screen (regression for the SignInCancelledException path in
+# coves_auth_service.dart). The sign-in-page Cancel variant of the same
+# redirect is covered by a3_wrong_password.
+# PRECONDITION: app signed out (run after a2_signout_landing / a3).
+# Leaves the app signed out on the login screen.
+# QUIRK: Chrome's "Save password?" sheet may float over the consent page;
+# it does not cover the Deny/Authorize buttons — tap through it. Do NOT
+# press BACK to dismiss it: BACK closes the whole custom tab.
+appId: social.coves.dev
+---
+- launchApp
+- extendedWaitUntil:
+    visible: "Sign in|Welcome back"
+    timeout: 30000
+# launchApp normally resets to the landing screen; tolerate starting on the
+# login screen too.
+- runFlow:
+    when:
+      notVisible: "Welcome back"
+    commands:
+      - tapOn: "Sign in"
+      - extendedWaitUntil:
+          visible: "Welcome back"
+          timeout: 15000
+- tapOn: "alice.bsky.social"
+- inputText: "mari.local.coves.dev"
+- hideKeyboard
+- tapOn: "Sign in"
+# Chrome custom tab: PDS OAuth password page (localhost:3001)
+- extendedWaitUntil:
+    visible: "Password"
+    timeout: 30000
+- tapOn: "Password"
+- inputText: "password"
+- hideKeyboard
+# The web page has a "Sign in" heading and a "Sign in" button; the button is
+# the last match in the tree.
+- tapOn:
+    text: "Sign in"
+    index: 1
+# Consent page: deny instead of authorize
+- extendedWaitUntil:
+    visible: "Authorize"
+    timeout: 30000
+- tapOn: "Deny access"
+# Back in the app: quiet cancel message, login screen intact, no crash
+- extendedWaitUntil:
+    visible: "Sign in cancelled.*"
+    timeout: 30000
+- extendedWaitUntil:
+    visible: "Welcome back"
+    timeout: 15000
+- takeScreenshot: build/maestro/a_oauth_cancel_deny
diff --git a/.maestro/config.yaml b/.maestro/config.yaml
index a09cad5..2cbf7a0 100644
--- a/.maestro/config.yaml
+++ b/.maestro/config.yaml
@@ -46,3 +46,4 @@ executionOrder:
     - a2_signout_landing
     - d4_discovery_guest
     - a3_wrong_password
+    - a4_oauth_cancel