@@ -100,7 +100,11 @@ export function Person({ organizationId, memberId }: PersonProps) {
   const [editing, setEditing] = useState(false)
   const routes = organizationRoutes(organizationId)
   const originQuery = serializePeopleView({ ...origin, view: origin.view ?? 'directory' })
-  const data = query.isError ? undefined : query.data
+  const notFound = isApiClientError(query.error) && query.error.status === 404
+  const refused = isApiClientError(query.error) && query.error.status < 500
+  // A transient refresh failure keeps the loaded profile and any edit open on it; a refusal does not.
+  const loadError = query.data && !refused ? null : query.error
+  const data = loadError ? undefined : query.data
 
   const chartHref = serializePeopleView(routes.people, {
     ...origin,
@@ -129,14 +133,14 @@ export function Person({ organizationId, memberId }: PersonProps) {
         ) : undefined
       }
     >
-      {query.error ? (
-        isApiClientError(query.error) && query.error.status === 404 ? (
+      {loadError ? (
+        notFound ? (
           <SettingsEmptyState variant='inline'>
             This person isn't in your organization.
           </SettingsEmptyState>
         ) : (
           <SettingsQueryErrorState
-            error={query.error}
+            error={loadError}
             fallback='Could not load this person'
             isRetrying={query.isFetching}
             onRetry={() => void query.refetch()}
 
@@ -16,6 +16,7 @@ import {
   type PeopleSyncStatus,
   peopleSyncConfigSchema,
 } from '@/lib/api/contracts/people-sync'
+import { flattenFieldErrors } from '@/lib/api/contracts/primitives'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { useScimConnection } from '@/ee/scim/hooks/scim'
@@ -45,7 +46,9 @@ export function DirectorySyncForm({
   const [tenantId, setTenantId] = useState(current?.tenantId ?? '')
   const [clientId, setClientId] = useState(current?.clientId ?? '')
   const [secret, setSecret] = useState('')
-  const [fieldErrors, setFieldErrors] = useState<Record<string, string>>({})
+  const [fieldErrors, setFieldErrors] = useState<
+    Partial<Record<'domain' | 'token' | 'tenantId' | 'clientId' | 'clientSecret', string>>
+  >({})
   const { settingsFeatures } = useOrganizationContext()
   const provisioning = useScimConnection(organizationId, source === 'scim')
   const scimReady = provisioning.isSuccess && provisioning.data.connection?.status === 'active'
@@ -66,11 +69,7 @@ export function DirectorySyncForm({
           : { source }
     )
     if (!config.success) {
-      setFieldErrors(
-        Object.fromEntries(
-          config.error.issues.map((issue) => [String(issue.path[0]), issue.message])
-        )
-      )
+      setFieldErrors(flattenFieldErrors(config.error))
       return
     }
     setFieldErrors({})
 
@@ -102,7 +102,10 @@ export function PeopleChart({ organizationId, viewSwitch, onImport, onSync }: Pe
   const { focus, page } = origin
   const size = useIsMobile() ? 1 : 4
   const chart = usePeopleChart(organizationId, focus, Math.max(1, Math.min(page, 1_000_000)), size)
-  const branch = chart.isError ? undefined : chart.data
+  const notFound = isApiClientError(chart.error) && chart.error.status === 404
+  const refused = isApiClientError(chart.error) && chart.error.status < 500
+  // A transient refresh failure keeps the chart on screen; a refusal replaces it.
+  const branch = refused ? undefined : chart.data
   const profileQuery = serializePeopleView({
     ...origin,
     view: 'chart',
@@ -264,7 +267,7 @@ export function PeopleChart({ organizationId, viewSwitch, onImport, onSync }: Pe
           </div>
         </>
       ) : chart.error ? (
-        isApiClientError(chart.error) && chart.error.status === 404 ? (
+        notFound ? (
           <EmptyState
             title='Person unavailable'
             description='This person is no longer in your organization’s directory.'
 
@@ -190,7 +190,7 @@ export function PeopleDirectory({ organizationId }: PeopleProps) {
         rows={rows}
         onRowClick={(memberId) => router.push(profileHref(memberId))}
         onLoadMore={() => void people.fetchNextPage()}
-        hasMore={people.hasNextPage}
+        hasMore={people.hasNextPage && !changingFilter}
         isLoadingMore={people.isFetchingNextPage}
         isFetching={people.isFetching}
         loadMoreFailed={people.isFetchNextPageError}
 
@@ -167,7 +167,7 @@ function OrganizationSearchContent({ userId, chatId }: OrganizationSearchProps)
   const { recordQuery } = useSearchHistoryActions()
   const router = useRouter()
   const pathname = usePathname()
-  const hasSearchParams = useSearchParams().size > 0
+  const hasSearchParams = useSearchParams().toString() !== ''
   const routes = organizationRoutes(organization.id)
   const hasConversation = Boolean(chatId) || pathname.startsWith(`${routes.search}/chat/`)
   const queryClient = useQueryClient()
 
@@ -160,6 +160,13 @@ describe('evidence-linked citations', () => {
       true
     )
     expect(persisted.sources).toEqual(live.sources)
+    const disguised = {
+      ...webOutput,
+      results: [{ ...webOutput.results[0], url: 'https://docs.example.test@attacker.test/cli' }],
+    }
+    expect(
+      resolveMessageCitations(webBlocks('success', true, disguised), '', true).sources
+    ).toEqual([])
     expect(
       resolveMessageCitations(webBlocks('error', false, webOutput), '', true).blocks[1].content
     ).toBe('Install it ')
 
@@ -189,8 +189,8 @@ export function categorizeMcpServerError(
 }
 
 /**
- * Enhanced error categorization for more specific HTTP status codes.
- * Returns safe, generic messages to prevent leaking internal details.
+ * HTTP status and safe, generic message for any error: Sim's own MCP error classes
+ * first, then message matching for SDK and third-party errors.
  */
 export function categorizeError(error: unknown): { message: string; status: number } {
   if (!(error instanceof Error)) {
 
@@ -14,8 +14,8 @@ type RetrievalCitationSource = {
   snippet?: string
 }
 
-/** Tools whose successful results supply sources: connected-source retrieval and public web research. */
 const WEB_TOOLS = new Set(['web_search', 'web_fetch'])
+/** Tools whose successful results supply sources: connected-source retrieval and public web research. */
 const CITATION_TOOLS = new Set(['search_workspace', 'read_document', ...WEB_TOOLS])
 
 /** Whether a successful result of this tool may supply source destinations. */
@@ -80,7 +80,9 @@ export function collectRetrievalCitationEvidence(blocks: readonly RetrievalCitat
         continue
       try {
         const url = new URL(result.citationUrl)
+        // A web page can steer a fetched URL, so `https://trusted.example@other.example` never cites.
         if (url.protocol !== 'https:' && url.protocol !== 'http:') continue
+        if (url.username || url.password) continue
       } catch {
         continue
       }
 
@@ -44,6 +44,15 @@ const reportsResponse = z.object({
   '@odata.nextLink': z.string().min(1).max(MAX_NEXT_LINK_LENGTH).optional(),
 })
 
+const deletedUserResponse = z.object({
+  error: z.object({ code: z.literal('Request_ResourceNotFound') }),
+})
+
+/** A user deleted after the users phase has no reports left to read; any other 404 still fails. */
+function isDeletedUser(status: number, body: unknown) {
+  return status === 404 && deletedUserResponse.safeParse(body).success
+}
+
 /** App-only Graph tokens cannot read /manager; each user's /directReports supports User.Read.All. */
 async function readReportPages(
   items: readonly DirectoryReportRequest[],
@@ -101,6 +110,8 @@ async function readReportPages(
     const timing = { get: (name: string) => headers.get(name) ?? null }
     const retryAfterMs = directoryRetryDelay(response.status, timing)
     if (retryAfterMs !== null) return { managerId: page.managerId, retryAfterMs }
+    if (isDeletedUser(response.status, response.body))
+      return { managerId: page.managerId, reportIds: [], next: null }
     requireDirectorySuccess(response.status, timing)
     const parsedReports = reportsResponse.safeParse(response.body)
     if (!parsedReports.success)
 
@@ -312,7 +312,7 @@ it('rotates credentials without bypassing a provider cooldown or publishing the
   expect(rows).toEqual([{ id: director, title: 'President' }])
 })
 
-it('resumes a large Entra hierarchy without replaying successful batch siblings or creating accounts', async () => {
+it('resumes a large Entra hierarchy past a user deleted mid-read without replaying successful batch siblings or creating accounts', async () => {
   const total = 10007
   const tenantId = generateId()
   const graphConfig = {
@@ -378,6 +378,12 @@ it('resumes a large Entra hierarchy without replaying successful batch siblings
           body: { error: graphConfig.clientSecret },
         }
       }
+      if (managerId === employee(2))
+        return {
+          id: request.id,
+          status: 404,
+          body: { error: { code: 'Request_ResourceNotFound' } },
+        }
       if (managerId !== lead) return { id: request.id, status: 200, body: { value: [] } }
       const offset = Number(target.searchParams.get('$skiptoken') || 0)
       const length = Math.min(1000, total - 1 - offset)