diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 191e29a9bce..66694c9d63d 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -231,8 +231,10 @@ jobs:
         run: >-
           bunx vitest run --mode integration
           lib/knowledge/__integration__/search-source-progress.integration.ts
+          lib/knowledge/__integration__/organization-search-overview.integration.ts
           lib/knowledge/__integration__/search-source-pagination.integration.ts
           lib/knowledge/__integration__/search-reference-batching.integration.ts
+          lib/knowledge/__integration__/embedding-insert-batches.integration.ts
           lib/knowledge/__integration__/kb-block-search.integration.ts
           lib/core/outbox/service.integration.ts
           lib/knowledge/__integration__/connector-upload.integration.ts
diff --git a/apps/docs/content/docs/knowledgebase/connectors.mdx b/apps/docs/content/docs/knowledgebase/connectors.mdx
index 31110c79c1c..e3624676668 100644
--- a/apps/docs/content/docs/knowledgebase/connectors.mdx
+++ b/apps/docs/content/docs/knowledgebase/connectors.mdx
@@ -16,11 +16,11 @@ Connectors continuously sync documents from external services into your knowledg
 
 <Image src="/static/connectors/connectors-sources.png" alt="The current Connect Source picker showing searchable connectors including Airtable, Asana, Ashby, Azure DevOps, Bitbucket, Box, and ClickUp" width={750} height={680} className="mx-auto h-auto w-full max-w-md" />
 
-Sim ships with 64 built-in connectors:
+Sim ships with 66 built-in connectors:
 
 | Category | Connectors |
 |----------|-----------|
-| **Productivity** | Notion, Confluence, Asana, Linear, Jira, Jira Service Management, Monday, Trello, ClickUp, Google Calendar, Google Sheets, Google Forms, Microsoft Excel, Typeform |
+| **Productivity** | Coda, Notion, Confluence, Asana, Linear, Jira, Jira Service Management, Monday, Trello, ClickUp, Google Calendar, Google Sheets, Google Forms, Microsoft Excel, Typeform |
 | **Cloud Storage** | Google Drive, Dropbox, OneDrive, SharePoint, Box, Amazon S3, SFTP |
 | **Documents** | Google Docs, Google Slides, Mintlify, WordPress, Webflow, DocuSign |
 | **Development** | GitHub, GitLab, Bitbucket, Azure DevOps, Sentry |
@@ -31,7 +31,7 @@ Sim ships with 64 built-in connectors:
 | **Incident Management** | incident.io, Rootly, PagerDuty |
 | **Data** | Airtable, Databricks |
 | **Note-taking** | Obsidian |
-| **Meetings** | Zoom, Google Meet, Gong, Grain, Granola, Fathom, Fireflies |
+| **Meetings** | Zoom, Google Meet, Gong, Grain, Granola, Fathom, Fireflies, Circleback |
 | **Recruiting** | Greenhouse, Ashby |
 | **HR** | Workday Help |
 | **Compliance** | Google Vault |
@@ -52,6 +52,7 @@ Other connectors use **API keys** or **personal access tokens** instead. The set
 | Connector | Where to get the key |
 |-----------|---------------------|
 | **Obsidian** | Install the [Local REST API](https://github.com/coddingtonbear/obsidian-local-rest-api) plugin, then copy the key from its settings |
+| **Coda** | API token from Account settings → API connections, saved as a Coda service account credential |
 | **Fireflies** | Generate from the Integrations page in your Fireflies account |
 | **Typeform** | Personal access token from your Typeform account settings |
 | **Azure DevOps** | Personal access token with Wiki (Read), Work Items (Read), and Code (Read) scopes |
diff --git a/apps/docs/content/docs/search/coda.mdx b/apps/docs/content/docs/search/coda.mdx
new file mode 100644
index 00000000000..c2a276f7cf5
--- /dev/null
+++ b/apps/docs/content/docs/search/coda.mdx
@@ -0,0 +1,66 @@
+---
+title: Coda
+description: Connect Coda documents while preserving each teammate's access
+---
+
+import { Step, Steps } from 'fumadocs-ui/components/steps'
+import { Image } from '@/components/ui/image'
+
+An organization admin connects Coda once. Teammates search using their verified Sim email address; they do not need a personal Coda connection. Their email must match the address Coda reports.
+
+## Connect Coda
+
+<Steps>
+<Step>
+
+### Create an API token
+
+Sign in to Coda with a dedicated integration account that can read the documents and their sharing permissions. Open **Account settings → API connections → Generate API token**, name the token, and copy it. Coda's current app may be labeled **Superhuman Docs**.
+
+Use a standard REST API token. Do not select the MCP restriction.
+
+<Image className="mx-auto h-auto w-full max-w-2xl" src="/static/search/coda-api-token.jpg" alt="Coda API connections with the Generate new token dialog" width={1280} height={720} />
+
+</Step>
+<Step>
+
+### Add the source
+
+In Sim, open **Settings → Sources → Add source → Coda**. Add or select a Coda service account credential and enter the token when prompted.
+
+| Field | What to enter |
+|---|---|
+| Documents | Select documents, or switch to **Document IDs** and enter up to 100 IDs separated by commas. For `https://coda.io/d/_dAbCDeFGH`, the ID is `AbCDeFGH`. |
+| Enterprise organization ID | Leave blank for ordinary access. For organization-wide indexing, enter the ID from Coda's [List organizations API](https://coda.io/developers/apis/admin/v1#operation/listOrganizations) and use an Enterprise organization administrator's token. Workspace admin access alone is insufficient. |
+
+The picker shows accessible documents the token owner has opened. Use IDs for other accessible documents. With no selection, Sim discovers the token owner's opened documents, or the organization's documents in Enterprise mode. Use explicit IDs when deleted documents must reliably be removed from the index; discovery listings alone are not authoritative for deletion.
+
+</Step>
+<Step>
+
+### Sync and verify
+
+Select **Connect & Sync**. Open the source's **Documents** and **Sync history** to check indexing. Content and permission changes appear after synchronization.
+
+To rotate the token, add the replacement credential, update the source, and verify a sync before revoking the old token.
+
+</Step>
+</Steps>
+
+## Content and access
+
+Ordinary connections index visible canvas text and base-table rows. Enterprise connections index the Admin API's plaintext page exports; tables are included only as represented in those exports. Attachments, comments, images, and remote embeds are not extracted.
+
+| Permission | Ordinary connection | Enterprise connection |
+|---|---|---|
+| Owner or direct email share | Matching verified Sim email | Matching active organization user |
+| Group, workspace, or domain share | Not expanded | Resolved through the Admin API |
+| Anyone with the link | Does not grant Search access | Does not grant Search access |
+
+Enterprise mode excludes deactivated and deleted users. Direct-share guests absent from the organization directory are excluded; guests explicitly listed in a group or workspace may receive that membership's access. Ordinary connections cannot check Coda organization deactivation, so manage departing users' Sim membership too.
+
+Sim refreshes permissions even when content is unchanged. Unverified permissions never become broad access, and Sim admin status does not override Coda sharing. For setup failures or missing results, check the token's access, Enterprise admin role if applicable, the teammate's verified email, and **Sync history**.
+
+In a regular knowledge base, **Workspace access** intentionally shares all indexed content with that Sim workspace and does not use the Enterprise organization ID. The permissions above apply to organization Search and **Admin access** sources.
+
+See Coda's [public API](https://coda.io/developers/apis/v1) and [Enterprise Admin API](https://coda.io/developers/apis/admin/v1).
diff --git a/apps/docs/content/docs/search/confluence.mdx b/apps/docs/content/docs/search/confluence.mdx
index ad8475e2b56..d07af6163bf 100644
--- a/apps/docs/content/docs/search/confluence.mdx
+++ b/apps/docs/content/docs/search/confluence.mdx
@@ -142,7 +142,7 @@ In **Sync history**, **Continuing** means a healthy listing needs another batch.
 | Space picker is empty or fails | Check the domain, account's space access, and `read:space:confluence` scope. Manual space keys are also supported. |
 | Service-account validation fails | Check token expiry, site, Confluence app access, and the full scope list above, including `read:confluence-user`. |
 | Content syncs but Search is empty | Connect your personal Confluence identity. Check permission/directory sync errors and group-read scopes. |
-| **Some permissions could not be verified** | Open the source's **Sync history**. Check the service account's space, page, and directory access. If access is correct and the warning persists, ask your operator to inspect the connector run's permission errors. Do not broaden sharing to clear the warning. |
+| **Permission verification incomplete** | Open the source's **Sync history**. Check the service account's space, page, and directory access. If access is correct and the warning persists, ask your operator to inspect the connector run's permission errors, including incomplete or repeated permission pages. Documents without verified access stay hidden; do not broaden sharing to clear the warning. |
 | A new page, blog post, or label is missing | Confluence search can take time to update. Once the content appears in Confluence search with the selected label, sync again. |
 | A restricted page is missing | Both your account and the crawling account need access to the page and its ancestors. |
 | Embedded content is missing | Index the referenced page separately; remote macro output is excluded. |
diff --git a/apps/docs/content/docs/search/connect-your-account.mdx b/apps/docs/content/docs/search/connect-your-account.mdx
index b82cdf817a2..6d741241fe1 100644
--- a/apps/docs/content/docs/search/connect-your-account.mdx
+++ b/apps/docs/content/docs/search/connect-your-account.mdx
@@ -60,6 +60,7 @@ For a source configured inside a workspace, join that workspace and connect thro
 | GitHub App installation | Connect GitHub once for this Sim organization. The App handles indexing; your account establishes which repositories you may search. |
 | Confluence service account | Connect Confluence to verify your identity; the service account handles the crawl. |
 | Google Workspace service account (Gmail, Calendar, Drive) | No personal connection is needed for that source. Your verified Sim email identifies your mailbox and calendar view, or is matched to Drive permissions. |
+| [Coda](/search/coda) | No personal connection is needed. Your verified Sim email must match a supported Coda sharing grant. |
 | GitLab | No personal connection is needed. For an administrator token, your verified Sim email must match your confirmed primary GitLab email. For a non-admin token, it must match the uploaded user mapping and have a project grant. |
 
 Gmail, Calendar, and Drive are separate Search sources. Connecting one Google service does not connect all of them. Central Google and GitLab sources remain searchable without a personal account connection.
diff --git a/apps/docs/content/docs/search/gmail.mdx b/apps/docs/content/docs/search/gmail.mdx
index 0d86d7a59e9..ecb646f4e65 100644
--- a/apps/docs/content/docs/search/gmail.mdx
+++ b/apps/docs/content/docs/search/gmail.mdx
@@ -133,7 +133,7 @@ Search schedules syncs hourly. The first sync lists every thread in scope and ca
 
 **Member accounts:** later syncs use each mailbox's Gmail change history, unless the configuration has a search filter. A full relisting runs about weekly, or sooner if Gmail no longer retains the saved history.
 
-**Service account:** each sync revisits the selected active mailboxes and resumes unfinished listings. A failed mailbox read leaves the crawl incomplete; it does not cause existing indexed mail to be deleted from Search.
+**Service account:** each sync revisits the selected active mailboxes and resumes unfinished listings. If Google reports that a user's mailbox is not set up or returns a mailbox `failedPrecondition`, Sim records a warning and continues with the remaining users. The crawl stays incomplete and retries affected users on the next scheduled crawl; existing indexed mail is not deleted because a mailbox could not be read. Credential, delegation, and Directory failures still stop the crawl.
 
 Updates, removals, and access refresh in the background. Empty mailboxes and filters with no matches complete normally with zero documents. Threads exceeding indexing size limits are skipped and reconsidered when they change.
 
@@ -149,7 +149,7 @@ An individual thread failure does not mean the whole mailbox failed. Sim retries
 | Reconnect | Click **Reconnect** and authorize the same account again. |
 | Unavailable or needs admin attention | Ask your Sim admin to check source status and the deployment's Google OAuth configuration. |
 | Directory or delegation error | Check both central crawl scopes, the service-account key, and the Directory administrator's user-read privileges. A normal OAuth account cannot replace the central service account. |
-| Gmail access fails for a selected user | Verify delegation is authorized and [Gmail is enabled](https://knowledge.workspace.google.com/admin/gmail/control-gmail-access-for-your-organizations-users) for that primary Workspace account. Set **Users** to accounts with Gmail enabled; leaving it blank includes all active users and can stop sync on a service-access error. Aliases and external accounts cannot be selected. |
+| Gmail access fails for a selected user | Verify delegation is authorized and [Gmail is enabled](https://knowledge.workspace.google.com/admin/gmail/control-gmail-access-for-your-organizations-users) for that primary Workspace account. Check the affected users in **Sync history**. Set **Users** to accounts with Gmail enabled if some active users should not be crawled. Aliases and external accounts cannot be selected. |
 | A central source indexes mail but a teammate sees no results | Confirm their verified Sim email is the mailbox's primary email and they belong to the Sim organization. Administrators do not receive other people's mailbox access. |
 
 ## Self-hosted operator setup
diff --git a/apps/docs/content/docs/search/google-calendar.mdx b/apps/docs/content/docs/search/google-calendar.mdx
index a2317d9d941..817e7acf770 100644
--- a/apps/docs/content/docs/search/google-calendar.mdx
+++ b/apps/docs/content/docs/search/google-calendar.mdx
@@ -131,7 +131,7 @@ Sim indexes event titles, descriptions, times, locations, and the selected atten
 
 Cancelled events, attachment contents, meeting recordings, and transcripts are not indexed. Status entries such as working location, out of office, focus time, and birthdays, and automatically generated reservation events from Gmail are not indexed. Events Google returns only as free/busy blocks, without searchable details, are not indexed. Events outside the selected date window are excluded. Private event details that Google withholds are not available in Search; see [Google's calendar sharing rules](https://developers.google.com/workspace/calendar/api/concepts/sharing).
 
-Search schedules syncs hourly. Event edits, cancellations, access changes, inactive or removed users, and events moving outside the date window are reconciled during completed background syncs. Central crawls page through each selected user and resume unfinished work before removing documents no longer listed. Authorization, quota, and provider failures stop the sync rather than treating unread calendars as empty. The first sync may take longer, and results appear as indexing progresses; Search is not a live Calendar read.
+Search schedules syncs hourly. Event edits, cancellations, access changes, inactive or removed users, and events moving outside the date window are reconciled during completed background syncs. Central crawls page through each selected user and resume unfinished work before removing documents no longer listed. If an individual user's event listing returns a `403` with an explicit `forbidden` reason and no other reasons, Sim records a warning and continues with the remaining users. The crawl stays incomplete and retries affected users on the next scheduled crawl; unread calendars are not treated as empty. A `403` without a reason stops the crawl because its cause is unknown. Credential, delegation, Directory, and other provider failures still stop the crawl. The first sync may take longer, and results appear as indexing progresses; Search is not a live Calendar read.
 
 ## Troubleshooting
 
@@ -146,7 +146,7 @@ When a sync fails, **Sync history** includes the Google API operation, HTTP stat
 | Reconnect | Click **Reconnect** and complete Google authorization again. Allow pop-ups if the connection tab does not open. |
 | Unavailable or needs admin attention | Ask your Sim admin to check source status and the deployment's Google OAuth configuration. |
 | Service-account authorization or Directory error | Confirm both delegated scopes, enabled APIs, and the Directory administrator's user-read privilege. Check whether delegation still awaits approval or propagation. |
-| Calendar is disabled for a selected user | An active Workspace user may have Calendar turned off. [Enable Calendar](https://knowledge.workspace.google.com/admin/users/access/turn-calendar-on-or-off-for-users) for them, or set **Users** to accounts with Calendar enabled. Leaving **Users** blank includes all active users and can stop sync on a service-access error. |
+| Calendar access fails for a selected user | Check the affected users in **Sync history**. An active Workspace user may have Calendar turned off, but a `403` alone does not prove this. Check their access to the selected calendars and [Calendar service settings](https://knowledge.workspace.google.com/admin/users/access/turn-calendar-on-or-off-for-users), or set **Users** to accounts that should be crawled. |
 | User not found or inactive | Use an active primary email in the same Workspace customer. Aliases, external or guest accounts, suspended users, and archived users cannot be selected. |
 | A central source has no results for a teammate | Confirm their primary Workspace email matches their verified Sim email, they belong to the Sim organization, and they are included in **Users**. Check calendar IDs and **Sync history**. |
 
diff --git a/apps/docs/content/docs/search/google-drive.mdx b/apps/docs/content/docs/search/google-drive.mdx
index 3c70e3ccb62..2dd2d0237e9 100644
--- a/apps/docs/content/docs/search/google-drive.mdx
+++ b/apps/docs/content/docs/search/google-drive.mdx
@@ -155,13 +155,14 @@ Search schedules syncs hourly. Central crawls revisit the selected users' files
 
 ## Troubleshooting
 
-**Directory permission sync failed** means Sim could not fully verify group membership. Check the Directory administrator’s access to the affected group and any nested groups; this is separate from file-download access. An incomplete membership read does not replace the last verified membership, which remains subject to freshness checks.
+Directory permission warnings mean Sim could not fully verify group membership. When other groups refresh successfully and only nested groups outside your Workspace customer deny access or cannot be found, Sim continues syncing content and reports a partial permission sync. An incomplete membership read does not replace or refresh the last verified membership, which remains subject to freshness checks. Directory-wide failures still stop the sync. Check the Directory administrator’s access to the affected group and nested groups; this is separate from file-download access.
 
 | Problem | Next step |
 | --- | --- |
 | Google rejects authorization (`unauthorized_client`) | In **Manage Domain Wide Delegation**, verify the numeric **Client ID** matches `client_id` in the JSON key uploaded to Sim and all required scopes appear under **View details**. Check pending approval and allow time for recent changes to propagate. Changing the OAuth consent screen alone does not authorize delegation. |
 | Directory access failed | Check all four delegated scopes and the **Directory administrator email** user's administrator privileges. A normal Google OAuth credential cannot supply this central Search path. |
 | Missing files in a central crawl | Check **Users**, folder and file-type filters, and whether selected active Workspace users can download the file and read its permissions. Opening a file alone does not prove either. Check Sync history for errors. Files reachable only by excluded or inactive accounts are not crawled; files with unverified permissions stay hidden. |
+| No text could be extracted | Images and scanned PDFs use OCR, but files with no extractable text cannot be indexed. Check whether the original contains readable text; a successful download does not guarantee searchable content. |
 | User not found or inactive | Use a primary email in the same Google Workspace customer. Aliases, external or guest accounts, suspended users, and archived users cannot be selected for crawling. |
 | A teammate sees no results | Confirm they have joined the Sim organization and their verified Sim email matches the Drive permission or group membership. For member accounts, finish their personal Drive connection too. |
 | A public or shared-link file is missing | Check **Openly shared files**. Link-only sharing does not grant Search access. A named user or group permission can still make the file searchable. |
diff --git a/apps/docs/content/docs/search/meta.json b/apps/docs/content/docs/search/meta.json
index 473704f2d45..8a83d115762 100644
--- a/apps/docs/content/docs/search/meta.json
+++ b/apps/docs/content/docs/search/meta.json
@@ -3,6 +3,7 @@
   "pages": [
     "connect-your-account",
     "mcp",
+    "coda",
     "confluence",
     "github",
     "gitlab",
diff --git a/apps/docs/public/static/search/coda-api-token.jpg b/apps/docs/public/static/search/coda-api-token.jpg
new file mode 100644
index 00000000000..09aa99e08eb
Binary files /dev/null and b/apps/docs/public/static/search/coda-api-token.jpg differ
diff --git a/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.test.tsx b/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.test.tsx
index d277c6a025d..c97e4c8a3c4 100644
--- a/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.test.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.test.tsx
@@ -5,6 +5,7 @@ import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { ApiClientError } from '@/lib/api/client/errors'
 import type { ConnectorData } from '@/lib/api/contracts/knowledge/connectors'
+import { SOURCE_PERMISSION_ERROR } from '@/lib/knowledge/connectors/sync-limits'
 import type { ConnectorActionsOptions } from '@/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/use-connector-actions'
 
 const mocks = vi.hoisted(() => ({
@@ -257,6 +258,75 @@ describe('organization source detail navigation', () => {
     )
   })
 
+  it.each(['active', 'pending', 'syncing'] as const)(
+    'keeps the safe permission warning visible while a source is %s',
+    async (status) => {
+      mocks.detail.mockReturnValue({
+        data: { ...connector, accessMode: 'admin', status, lastSyncError: SOURCE_PERMISSION_ERROR },
+      })
+      await render()
+      expect(container.textContent).toContain('Permission verification incomplete')
+      expect(container.textContent).toContain(SOURCE_PERMISSION_ERROR)
+      expect(container.textContent).not.toContain(
+        'Review the connection settings and try syncing again.'
+      )
+    }
+  )
+
+  it.each(['idle', 'pending', 'running'] as const)(
+    'preserves a connector permission warning alongside a member error while %s',
+    async (memberSyncStatus) => {
+      mocks.detail.mockReturnValue({
+        data: {
+          ...connector,
+          accessMode: 'members',
+          memberSyncStatus,
+          lastSyncError: SOURCE_PERMISSION_ERROR,
+          lastMemberSyncError: 'Private member error details',
+        },
+      })
+      await render()
+      expect(container.textContent).toContain('Permission verification incomplete')
+      expect(container.textContent).toContain(SOURCE_PERMISSION_ERROR)
+      expect(container.textContent).not.toContain('Private member error details')
+    }
+  )
+
+  it.each(['active', 'pending', 'syncing'] as const)(
+    'keeps permission warnings visible alongside other sync notices while %s',
+    async (status) => {
+      mocks.detail.mockReturnValue({
+        data: {
+          ...connector,
+          accessMode: 'admin',
+          status,
+          lastSyncError: [
+            'Directory refresh incomplete: Private directory details',
+            'Source listing failed for 1 account. Private account details',
+            SOURCE_PERMISSION_ERROR,
+          ].join('\n'),
+        },
+      })
+      await render()
+      expect(container.textContent).toContain('Permission verification incomplete')
+      expect(container.textContent).toContain(SOURCE_PERMISSION_ERROR)
+      expect(container.textContent).not.toContain('Private directory details')
+      expect(container.textContent).not.toContain('Private account details')
+      expect(container.textContent).not.toContain(
+        'Review the connection settings and try syncing again.'
+      )
+    }
+  )
+
+  it('does not classify a provider message containing the permission text as its own notice', async () => {
+    mocks.detail.mockReturnValue({
+      data: { ...connector, lastSyncError: `Provider message: ${SOURCE_PERMISSION_ERROR}` },
+    })
+    await render()
+    expect(container.textContent).toContain('Some connection updates are incomplete')
+    expect(container.textContent).not.toContain('Permission verification incomplete')
+  })
+
   it.each(['', '?view=settings', '?view=history'])(
     'shows integration deactivation independently of source sync state at %s',
     async (searchParams) => {
diff --git a/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.tsx b/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.tsx
index df92230fa62..ae654870d01 100644
--- a/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.tsx
+++ b/apps/sim/app/o/[organizationId]/settings/integrations/sources/[connectorId]/source-detail.tsx
@@ -12,6 +12,7 @@ import { useSettingsUnsavedGuard } from '@/components/settings/use-settings-unsa
 import { isApiClientError } from '@/lib/api/client/errors'
 import type { ConnectorData, ConnectorDetailData } from '@/lib/api/contracts/knowledge/connectors'
 import type { ResourceScope } from '@/lib/core/resource-scope'
+import { SOURCE_PERMISSION_ERROR } from '@/lib/knowledge/connectors/sync-limits'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import { describeSearchSource } from '@/lib/sim-search/source-identity'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
@@ -186,6 +187,8 @@ function SourceDetailContent({
     ? describeSearchSource(meta, connector.sourceConfig) || meta.name
     : 'Connection'
   const { effectiveStatus, lastSyncError } = getConnectorSyncState(connector)
+  const permissionsIncomplete =
+    connector.lastSyncError?.split('\n').includes(SOURCE_PERMISSION_ERROR) ?? false
   const status =
     effectiveStatus === 'paused'
       ? 'Sync paused'
@@ -271,12 +274,23 @@ function SourceDetailContent({
     >
       {integrationFeedback}
       <SourceNavigation view={view} onViewChange={onViewChange} />
-      {effectiveStatus === 'active' && lastSyncError && (
-        <SettingsResourceRow
-          title='Some connection updates are incomplete'
-          description='Review the connection settings and try syncing again.'
-        />
-      )}
+      {lastSyncError &&
+        (effectiveStatus === 'active' ||
+          (permissionsIncomplete &&
+            (effectiveStatus === 'pending' || effectiveStatus === 'syncing'))) && (
+          <SettingsResourceRow
+            title={
+              permissionsIncomplete
+                ? 'Permission verification incomplete'
+                : 'Some connection updates are incomplete'
+            }
+            description={
+              permissionsIncomplete
+                ? SOURCE_PERMISSION_ERROR
+                : 'Review the connection settings and try syncing again.'
+            }
+          />
+        )}
       <ConnectorRecovery
         connector={connector}
         knowledgeBaseId={connector.knowledgeBaseId}
diff --git a/apps/sim/connectors/coda/README.md b/apps/sim/connectors/coda/README.md
new file mode 100644
index 00000000000..1b2ae294e9b
--- /dev/null
+++ b/apps/sim/connectors/coda/README.md
@@ -0,0 +1,79 @@
+# Coda connector decisions and verification
+
+## Precedent and authentication
+
+| Reference | Verified behavior | What it establishes for Sim |
+| --- | --- | --- |
+| [Glean Coda search](https://www.glean.com/connectors/coda) | Native document/page indexing with query-time source permissions. | The same access-control objective. The public page does not specify the crawler's credentials, endpoints, directory expansion, or deletion strategy; exact implementation parity is not established. |
+| [Glean Coda agent service credential](https://docs.glean.com/administration/agent-identity/coda) | A dedicated Coda user and an MCP-restricted token for agent tools. | Dedicated identity and credential rotation are useful operational precedent. This is a separate MCP integration, not the REST indexing setup; its MCP token restriction must not be copied into Sim's connector instructions. |
+| [Onyx Coda connector](https://github.com/onyx-dot-app/onyx/blob/5fe6573c3c155e1a75b51de32d4988ee6c82164e/backend/onyx/connectors/coda/connector.py) | A bearer token, optional workspace scope, page content, and table rows through the public REST API. | Direct precedent for ordinary content ingestion. Sim uses bounded deferred hydration rather than collecting the entire source before indexing. |
+
+Onyx's [test setup](https://github.com/onyx-dot-app/onyx/blob/5fe6573c3c155e1a75b51de32d4988ee6c82164e/backend/tests/daily/connectors/coda/README.md) also uses an API token generated in account settings. Its reviewed Coda implementation has no source ACL or directory calls, and its [permission-sync registry](https://github.com/onyx-dot-app/onyx/blob/5fe6573c3c155e1a75b51de32d4988ee6c82164e/backend/ee/onyx/external_permissions/sync_params.py) has no Coda entry. It therefore does not establish Enterprise permission parity. Coda's own API documentation is the authority for Sim's Enterprise path.
+
+This connector reuses Sim's existing `coda-service-account` token credential and its selector. The metadata's `oauth` discriminator means “use a stored credential” in the shared connector framework. The actual credential is an API token, with no OAuth authorization or refresh flow. Personal credential-group enrollment is not exposed because that flow currently requires OAuth. Admin indexing matches provider-reported grants to verified Sim emails instead.
+
+## API contract audit
+
+All connector requests are GET requests authenticated with `Authorization: Bearer`. The following operation IDs were checked against the OpenAPI specifications embedded in Coda's [public reference](https://coda.io/developers/apis/v1) and [Admin reference](https://coda.io/developers/apis/admin/v1), including query parameters, response fields, pagination, and allowed formats. None of these operations is deprecated.
+
+| API | Operations used |
+| --- | --- |
+| Public identity and discovery | `whoami`, `listDocs`, `getDoc` |
+| Public content | `listPages`, `getPage`, `listPageContent`, `listTables`, `getTable`, `listColumns`, `listRows` |
+| Public permissions | `getPermissions` |
+| Admin discovery | `getOrganization`, `listDocs` with `docIds` or `docAvailabilityState` and `fetchPermissionsMode=none` |
+| Admin content and permissions | `listPagesV2`, `getPageV2` with `outputFormat=LossyPlainText`, `listDocPermissionsV2` |
+| Admin directory | `listOrgUsers`, `listGroups`, `listGroupMembers`, `listWorkspaces`, `listWorkspaceUsers` |
+
+The Admin API requires an [Enterprise organization administrator](https://help.superhuman.com/hc/en-us/articles/46210125237901-Intro-to-Superhuman-Docs-Admin-API). Ordinary workspace admin access does not satisfy that requirement. All network calls use the shared secure fetch/retry path and fixed API origins; the connector uses no browser session, private endpoint, credential impersonation, or provider permission mutation. Synthetic directory groups are Sim's internal representation of documented grants, not invented Coda API objects. Size and crawl limits below are Sim safeguards, not claimed Coda service limits.
+
+## Access tradeoffs
+
+- Without an organization ID, only ownership and direct email grants establish individual access. Workspace, domain, group, and unknown principals are not expanded. Link possession never grants Search access. The public API does not provide organization account status; this mode cannot independently detect organization-level deactivation while a direct grant remains. Sim membership lifecycle must also be managed.
+- With an Enterprise organization ID, the Admin API supplies organization discovery and directory membership. Direct users and domains use synthetic groups so deactivated/deleted organization users cannot resolve grants. External direct-share guests absent from the organization directory are conservatively excluded. Explicit group/workspace guests remain eligible unless the directory reports them inactive.
+- Opaque group/workspace IDs are hex encoded before shared case-folding. Tenant IDs remain source-exact. This avoids merging case-sensitive Coda IDs.
+- Every listed document's complete ACL is read on every sync, independently of content hashes. Partial/failed ACLs are omitted so the shared engine fails closed. Directory snapshots are collected under the shared directory lease and never reported complete after a truncated response.
+- Permission freshness, query authorization, and directory persistence remain in the existing shared engines. Workspace access mode deliberately grants workspace-wide access and is separate from organization Search.
+
+## Content and pagination tradeoffs
+
+The [public API](https://coda.io/developers/apis/v1) exposes canvas plaintext and base-table rows; the [Admin API](https://coda.io/developers/apis/admin/v1) exposes `LossyPlainText` page exports. Admin exports are not equivalent to independently fetching every table. Hidden/embed/synced pages are excluded on the public path; the Admin API does not expose those public page-type flags. Neither path extracts arbitrary attachments or remote embeds.
+
+Admin document reads use the current workspace-qualified endpoints, resolving the workspace with the documented organization `docIds` filter. Metadata queries request `fetchPermissionsMode=none`; permissions come only from the complete paginated ACL endpoint.
+
+Listing defers content and retains only the current parent document metadata in the per-run context, avoiding one redundant parent fetch per child. Resource content and permissions are still read from the provider; ACLs never use that metadata cache. Discovery fetches ten parent documents at a time. Compound cursors persist that bounded queue, the current document, child phase, and provider token for durable replay, under the shared 512 KiB cursor limit. Only `pageToken` is sent on continuation requests, as Coda requires. No response URL or redirect receives the credential. Responses, text, list lengths, ACLs, directory entries, and pagination loops are bounded and fail rather than silently truncating. Responses are limited to 4 MiB, indexed text to 12 MiB, and hydration concurrency to two. The stubs advertise the text bound to the shared byte-budget scheduler. Directory entries are limited to 100,000, email lengths to 254, and document permissions to 5,000. Domain memberships are indexed once instead of scanning every user for every domain.
+
+Hashes use the parent document revision because table-list references do not guarantee a row-sensitive timestamp. A document edit invalidates all its children, trading extra reads for correctness. Explicit full resyncs also refresh rendered dependencies. When the Admin API omits its optional revision timestamp, the shared durable sync-generation ID forces one refresh per crawl, following the Slack/GitLab pattern. It remains stable across retries within that generation.
+
+Discovery order is mutable and the public list omits never-opened documents. Discovery is therefore non-authoritative for deletion reconciliation. Explicit document IDs provide authoritative scope; confirmed 404/410 documents reconcile, while 403s remain errors. Up to 100 explicit IDs are supported per source. Setup probes one document and one ACL page to keep request latency bounded; sync checks the remaining scope.
+
+## Reproducible checks
+
+From `apps/sim`:
+
+```sh
+bunx vitest run connectors/coda/coda.test.ts connectors/coda/permissions.test.ts lib/selectors/server/providers/coda.test.ts lib/credentials/token-service-accounts/validators/coda.test.ts lib/selectors/manifest.test.ts
+CODA_CONNECTOR_LIVE_TOKEN_FILE=/path/to/token bunx vitest run connectors/coda/coda.live.test.ts
+```
+
+The provider test creates and deletes its own document. `CODA_CONNECTOR_LIVE_ORGANIZATION_ID` enables additional Enterprise export/ACL/directory checks against that fixture when the token belongs to an Enterprise organization. Set `CODA_CONNECTOR_LIVE_FIXTURE_FILE=/path/to/fixture.json` to retain it for the application test, then from the repository root:
+
+```sh
+CODA_CONNECTOR_LIVE_TOKEN_FILE=/path/to/token \
+CODA_CONNECTOR_LIVE_FIXTURE_FILE=/path/to/fixture.json \
+CODA_CONNECTOR_LIVE_SECOND_EMAIL=second-user@example.com \
+bun scripts/test-knowledge-acls.ts coda-live.integration.ts
+```
+
+The application test uses disposable PostgreSQL/Redis, real credentials, Coda, source creation, ingestion, storage, and authorization. Set `CODA_CONNECTOR_LIVE_SCOPE=organization` to exercise organization credential creation and organization Search instead of a workspace knowledge base. Only embeddings are deterministic substitutes. It changes only the retained fixture's share, with notifications suppressed, and removes that share afterward. `CODA_CONNECTOR_LIVE_ALLOW_SHARING=false` explicitly skips the live grant/revoke cases when source policy prohibits sharing. `CODA_CONNECTOR_LIVE_UI_FIXTURE_FILE` optionally retains isolated rows and writes a temporary signed session for browser verification; use only with the runner's disposable-database retention options and remove both afterward.
+
+## Verification coverage
+
+- Focused connector, selector, credential, navigation, configuration, and integration-availability tests passed. App and deployment-config type checks, Biome, and the strict API-contract audit passed.
+- Live provider tests cover page/table hydration, page edits, and row edits. Coda's real initialization `409` led to an explicit retry path.
+- Real application setup and ingestion passed in both workspace and organization scope (the live sharing cases require a workspace that allows the intended cross-domain share). Organization scope creates the token credential through the authorized application use case. Owner search/chunks were allowed; another verified user, unverified owner, and workspace API key were denied. Embeddings were substituted, so external embedding-provider behavior was not tested.
+- Sim's browser showed the Coda source Active, both indexed documents, the live document picker, the saved organization credential, and preserved selection across connection/input modes. Browser checks caught and fixed missing Search URL registration, scope loss when switching modes, and deployment metadata rejecting Coda's token credential. Coda's official browser app showed the fixture content.
+- Live sharing to the requested second account was rejected by the source policy: “Cross domain sharing is prohibited.” Grant/revoke tests remain unverified live, with unit coverage for ACL changes and incomplete responses.
+- The available test account returned no Enterprise organizations; the official UI offers sales-assisted Enterprise setup rather than a self-service trial. Admin API behavior is checked against published schemas and mocked responses; organization-wide crawling, deactivation, and group/workspace/domain permission parity still require an Enterprise tenant test before being considered release-verified.
+
+These remaining provider prerequisites prevent claiming complete live verification.
diff --git a/apps/sim/connectors/coda/client.ts b/apps/sim/connectors/coda/client.ts
new file mode 100644
index 00000000000..b6a16206ebd
--- /dev/null
+++ b/apps/sim/connectors/coda/client.ts
@@ -0,0 +1,129 @@
+import { z } from 'zod'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { isRetryableError, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
+import { ConnectorSourceError } from '@/connectors/source-error'
+import { readBodyWithLimit } from '@/connectors/utils'
+import { buildCodaUrl, codaHeaders } from '@/tools/coda/utils'
+
+export const CODA_RESPONSE_BYTES = 4 * 1024 * 1024
+export const codaIdSchema = z.string().regex(/^[a-zA-Z0-9_-]{1,512}$/)
+export const codaEmailSchema = z.string().email().max(254)
+export const codaPageTokenSchema = z.string().min(1).max(4096)
+const timestampSchema = z.string().datetime({ offset: true })
+const sourceUrlSchema = z.string().url().max(4096)
+
+export const codaDocSchema = z.object({
+  id: codaIdSchema,
+  name: z.string().max(4096),
+  browserLink: sourceUrlSchema,
+  updatedAt: timestampSchema.optional(),
+  owner: codaEmailSchema.optional(),
+  workspaceId: codaIdSchema.optional(),
+  isDeleted: z.boolean().optional(),
+  keyAccessRevoked: z.boolean().optional(),
+})
+
+export const codaAdminDocSchema = codaDocSchema.required({ workspaceId: true })
+
+export const codaResourceSchema = z.object({
+  id: codaIdSchema,
+  name: z.string().max(4096),
+  browserLink: sourceUrlSchema,
+})
+
+export const codaPageSchema = codaResourceSchema.extend({
+  contentType: z.string(),
+  isHidden: z.boolean(),
+  isEffectivelyHidden: z.boolean(),
+})
+
+export const codaTableSchema = codaResourceSchema.extend({ tableType: z.string() })
+export type CodaDoc = z.infer<typeof codaDocSchema>
+export type CodaResource = z.infer<typeof codaResourceSchema>
+
+export function codaListSchema<T extends z.ZodType>(item: T) {
+  return z.object({
+    items: z.array(item).max(1000),
+    nextPageToken: codaPageTokenSchema.optional(),
+  })
+}
+
+/** Provider URLs are constructed locally; response links never receive the credential. */
+export async function codaJson<T extends z.ZodType>(
+  token: string,
+  path: string,
+  schema: T,
+  query?: Record<string, string | number | boolean | undefined>,
+  validating = false,
+  admin = false
+): Promise<z.output<T>> {
+  const response = await fetchWithRetry(
+    buildCodaUrl(path, query, admin ? 'admin' : 'public'),
+    { headers: codaHeaders(token), redirect: 'error' },
+    {
+      ...(validating ? VALIDATE_RETRY_OPTIONS : {}),
+      /** A newly created Coda doc returns 409 until its API snapshot is ready. */
+      fetcher: async (input, init, transport) => {
+        const response = await transport(input, init)
+        if (response.status === 409) {
+          await response.body?.cancel()
+          throw new ConnectorSourceError(
+            'Coda document is still initializing',
+            409,
+            'provider_unavailable'
+          )
+        }
+        return response
+      },
+      retryCondition: (error) =>
+        (error instanceof ConnectorSourceError && error.status === 409) || isRetryableError(error),
+    }
+  )
+  if (!response.ok) {
+    await response.body?.cancel()
+    throw new ConnectorSourceError(
+      `Coda request failed (${response.status})`,
+      response.status,
+      response.status === 401 || response.status === 403 ? 'authorization' : undefined
+    )
+  }
+  const body = await readBodyWithLimit(response, CODA_RESPONSE_BYTES)
+  if (!body) throw new Error('Coda response exceeded the 4MB limit')
+  let data: unknown
+  try {
+    data = JSON.parse(body.toString('utf8'))
+  } catch {
+    throw new Error('Coda returned invalid JSON')
+  }
+  const parsed = schema.safeParse(data)
+  if (!parsed.success) throw new Error('Coda returned an invalid response')
+  return parsed.data
+}
+
+/** Drains bounded collections without retaining their response bodies or following nextPageLink. */
+export async function* codaPages<T extends z.ZodType>(
+  token: string,
+  path: string,
+  schema: T,
+  query?: Record<string, string | number | boolean | undefined>,
+  admin = false
+) {
+  let pageToken: string | undefined
+  const seen = new Set<string>()
+  for (let page = 0; page < 1000; page++) {
+    const result = await codaJson(
+      token,
+      path,
+      codaListSchema(schema),
+      { limit: 100, ...query, pageToken },
+      false,
+      admin
+    )
+    yield result.items
+    pageToken = result.nextPageToken
+    if (!pageToken) return
+    if (seen.has(pageToken)) throw new Error('Coda repeated a pagination token')
+    seen.add(pageToken)
+  }
+  throw new Error('Coda exceeded the 1000-page safety limit')
+}
diff --git a/apps/sim/connectors/coda/coda.live.test.ts b/apps/sim/connectors/coda/coda.live.test.ts
new file mode 100644
index 00000000000..a2c9d8aa881
--- /dev/null
+++ b/apps/sim/connectors/coda/coda.live.test.ts
@@ -0,0 +1,225 @@
+/**
+ * Opt-in provider tests. Only documents created here are mutated or deleted.
+ * Set CODA_CONNECTOR_LIVE_TOKEN_FILE to a local token file. Optionally set
+ * CODA_CONNECTOR_LIVE_FIXTURE_FILE to retain the fixture for UI and access tests.
+ * @vitest-environment node
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+import { sleep } from '@sim/utils/helpers'
+import { generateShortId } from '@sim/utils/id'
+import { afterAll, describe, expect, it } from 'vitest'
+import { z } from 'zod'
+import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
+import { codaConnector } from '@/connectors/coda/coda'
+import type { ExternalDocument } from '@/connectors/types'
+import { buildCodaUrl, codaDocPath, codaHeaders } from '@/tools/coda/utils'
+
+const tokenPath = process.env.CODA_CONNECTOR_LIVE_TOKEN_FILE
+const fixturePath = process.env.CODA_CONNECTOR_LIVE_FIXTURE_FILE
+const token = tokenPath ? readFileSync(tokenPath, 'utf8').trim() : ''
+const resourceSchema = z.object({ id: z.string(), browserLink: z.string() })
+const mutationSchema = z.object({ requestId: z.string() })
+
+async function request<T extends z.ZodType>(
+  path: string,
+  schema: T,
+  method = 'GET',
+  body?: unknown
+) {
+  const response = await fetchWithRetry(buildCodaUrl(path), {
+    method,
+    headers: codaHeaders(token, body !== undefined),
+    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+    redirect: 'error',
+  })
+  if (!response.ok) throw new Error(`Live Coda ${method} failed (${response.status})`)
+  return schema.parse(await response.json())
+}
+
+async function waitFor<T>(read: () => Promise<T | undefined>): Promise<T> {
+  for (let attempt = 0; attempt < 60; attempt++) {
+    const value = await read()
+    if (value !== undefined) return value
+    await sleep(1000)
+  }
+  throw new Error('Coda did not converge within 60 seconds')
+}
+
+describe.skipIf(!token).sequential('Coda connector live', () => {
+  let docId = ''
+  let pageId = ''
+  let before: ExternalDocument[] = []
+  const marker = `SimConnector-${generateShortId()}`
+
+  async function list() {
+    const documents: ExternalDocument[] = []
+    let cursor: string | undefined
+    for (let count = 0; count < 10; count++) {
+      const result = await codaConnector.listDocuments(token, { docIds: [docId] }, cursor)
+      documents.push(...result.documents)
+      cursor = result.nextCursor
+      if (!result.hasMore) return documents
+    }
+    throw new Error('Unexpected fixture pagination')
+  }
+
+  afterAll(async () => {
+    if (docId && !fixturePath) {
+      await request(codaDocPath(docId), z.object({}), 'DELETE')
+    }
+  })
+
+  it('creates a disposable page and table, then lists and hydrates both through the connector', async () => {
+    const created = await request('/docs', resourceSchema, 'POST', {
+      title: `Sim Coda connector verification ${marker}`,
+      initialPage: {
+        name: 'Connector verification',
+        pageContent: {
+          type: 'canvas',
+          canvasContent: {
+            format: 'html',
+            content: `<h1>Connector verification</h1><p>${marker} initial content</p><table><tr><th>Name</th><th>Status</th></tr><tr><td>Verification row</td><td>Ready</td></tr></table>`,
+          },
+        },
+      },
+    })
+    docId = created.id
+    if (fixturePath)
+      writeFileSync(
+        fixturePath,
+        JSON.stringify({ docId, browserLink: created.browserLink, marker })
+      )
+    await waitFor(async () => {
+      const result = await codaConnector.validateConfig(token, { docIds: [docId] })
+      return result.valid ? true : undefined
+    })
+    before = await waitFor(async () => {
+      const documents = await list()
+      if (documents.length < 2) return undefined
+      for (const listed of documents) {
+        const hydrated = await codaConnector.getDocument(
+          token,
+          { docIds: [docId] },
+          listed.externalId
+        )
+        if (hydrated?.contentHash !== listed.contentHash) return undefined
+      }
+      return documents
+    })
+    expect(before.every((item) => item.contentDeferred && item.content === '')).toBe(true)
+    const page = before.find((item) => item.externalId.includes('/pages/'))!
+    pageId = page.externalId.split('/')[2]
+    const table = before.find((item) => item.externalId.includes('/tables/'))!
+    const pageContent = await codaConnector.getDocument(token, { docIds: [docId] }, page.externalId)
+    const tableContent = await codaConnector.getDocument(
+      token,
+      { docIds: [docId] },
+      table.externalId
+    )
+    expect(pageContent?.content).toContain(`${marker} initial content`)
+    expect(pageContent?.contentHash).toBe(page.contentHash)
+    expect(tableContent?.content).toContain('Name: Verification row')
+    expect(tableContent?.content).toContain('Status: Ready')
+    expect(tableContent?.contentHash).toBe(table.contentHash)
+    if (fixturePath)
+      writeFileSync(
+        fixturePath,
+        JSON.stringify({
+          docId,
+          pageId,
+          tableId: table.externalId.split('/')[2],
+          browserLink: created.browserLink,
+          marker,
+        })
+      )
+  }, 180_000)
+
+  it('detects page edits and fetches the updated body', async () => {
+    const mutation = await request(
+      codaDocPath(docId, 'pages', [pageId, 'pageId']),
+      mutationSchema,
+      'PUT',
+      {
+        contentUpdate: {
+          insertionMode: 'append',
+          canvasContent: { format: 'markdown', content: `${marker} updated content` },
+        },
+      }
+    )
+    await waitFor(async () => {
+      const result = await request(
+        `/mutationStatus/${encodeURIComponent(mutation.requestId)}`,
+        z.object({ completed: z.boolean() })
+      )
+      return result.completed ? true : undefined
+    })
+    const updated = await waitFor(async () => {
+      const documents = await list()
+      return documents[0].contentHash !== before[0].contentHash ? documents : undefined
+    })
+    const full = await codaConnector.getDocument(token, { docIds: [docId] }, updated[0].externalId)
+    expect(full?.content).toContain(`${marker} updated content`)
+    expect(full?.contentHash).toBe(updated[0].contentHash)
+  }, 180_000)
+  it('detects table row edits through the parent revision and hydrates current rows', async () => {
+    const table = (await list()).find((item) => item.externalId.includes('/tables/'))!
+    const tableId = table.externalId.split('/')[2]
+    const columns = await request(
+      codaDocPath(docId, 'tables', [tableId, 'tableId'], 'columns'),
+      z.object({ items: z.array(z.object({ id: z.string(), name: z.string() })) })
+    )
+    const nameColumn = columns.items.find((column) => column.name === 'Name')!
+    const mutation = await request(
+      codaDocPath(docId, 'tables', [tableId, 'tableId'], 'rows'),
+      mutationSchema,
+      'POST',
+      {
+        rows: [{ cells: [{ column: nameColumn.id, value: 'Second verification row' }] }],
+      }
+    )
+    await waitFor(async () => {
+      const status = await request(
+        `/mutationStatus/${encodeURIComponent(mutation.requestId)}`,
+        z.object({ completed: z.boolean() })
+      )
+      return status.completed ? true : undefined
+    })
+    const updated = await waitFor(async () => {
+      const current = (await list()).find((item) => item.externalId === table.externalId)
+      return current?.contentHash !== table.contentHash ? current : undefined
+    })
+    const full = await codaConnector.getDocument(token, { docIds: [docId] }, updated.externalId)
+    expect(full?.content).toContain('Name: Second verification row')
+    expect(full?.contentHash).toBe(updated.contentHash)
+  }, 180_000)
+
+  it.skipIf(!process.env.CODA_CONNECTOR_LIVE_ORGANIZATION_ID)(
+    'reads the fixture through the Enterprise Admin API and directory',
+    async () => {
+      const config = {
+        docIds: [docId],
+        organizationId: process.env.CODA_CONNECTOR_LIVE_ORGANIZATION_ID,
+      }
+      const context = { mirrorsSourceAcls: true, syncRunId: 'live-enterprise-verification' }
+      expect(await codaConnector.validateConfig(token, config, context)).toEqual({ valid: true })
+      const listed = await codaConnector.listDocuments(token, config, undefined, context)
+      expect(listed.documents.length).toBeGreaterThan(0)
+      const full = await codaConnector.getDocument(
+        token,
+        config,
+        listed.documents[0].externalId,
+        context
+      )
+      expect(full?.content).toContain(marker)
+      const acl = await codaConnector.getDocumentAcls!(token, config, listed.documents, context)
+      expect(acl[listed.documents[0].externalId]?.length).toBeGreaterThan(0)
+      const directory = await codaConnector.openDirectory!(token, config, context)
+      const groups = await directory!.listGroups()
+      expect(groups.length).toBeGreaterThan(0)
+      for (const group of groups.slice(0, 3)) {
+        expect((await directory!.listGroupMembers(group)).complete).toBe(true)
+      }
+    },
+    180_000
+  )
+})
diff --git a/apps/sim/connectors/coda/coda.test.ts b/apps/sim/connectors/coda/coda.test.ts
new file mode 100644
index 00000000000..df43c9ee634
--- /dev/null
+++ b/apps/sim/connectors/coda/coda.test.ts
@@ -0,0 +1,288 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { codaConnector } from '@/connectors/coda/coda'
+
+const doc = {
+  id: 'doc-1',
+  name: 'Handbook',
+  browserLink: 'https://coda.io/d/_ddoc-1',
+  updatedAt: '2026-09-16T00:00:00Z',
+}
+const page = {
+  id: 'canvas-1',
+  name: 'Welcome',
+  browserLink: 'https://coda.io/d/_ddoc-1/Welcome_s1',
+  contentType: 'canvas',
+  isHidden: false,
+  isEffectivelyHidden: false,
+}
+const table = {
+  id: 'grid-1',
+  name: 'Tasks',
+  browserLink: 'https://coda.io/d/_ddoc-1/Tasks_t1',
+  tableType: 'table',
+}
+const config = { docIds: ['doc-1'] }
+const line = (content: string) => ({ type: 'line', itemContent: { format: 'plainText', content } })
+
+describe('Coda connector', () => {
+  beforeEach(() => vi.restoreAllMocks())
+
+  it('reconciles a deleted explicit document but never treats authorization failure as deletion', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({}, { status: 404 }))
+      .mockResolvedValueOnce(Response.json({}, { status: 403 }))
+    expect(await codaConnector.listDocuments('token', config)).toMatchObject({
+      documents: [],
+      hasMore: false,
+      reconciliationSafe: true,
+    })
+    await expect(codaConnector.listDocuments('token', config)).rejects.toMatchObject({
+      status: 403,
+    })
+    expect(fetch).toHaveBeenCalledTimes(2)
+  })
+
+  it('rejects persisted document cursors after the configured scope changes', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+    const first = await codaConnector.listDocuments('token', config)
+    await expect(
+      codaConnector.listDocuments('token', { docIds: ['other'] }, first.nextCursor)
+    ).rejects.toThrow('different document scope')
+    expect(fetch).toHaveBeenCalledTimes(2)
+  })
+
+  it('validates one document and one ACL page using a bounded setup probe', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({ loginId: 'owner@example.com' }))
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json({ items: [], nextPageToken: 'more' }))
+    expect(
+      await codaConnector.validateConfig(
+        'token',
+        { docIds: ['doc-1', 'doc-2'] },
+        { mirrorsSourceAcls: true }
+      )
+    ).toEqual({ valid: true })
+    expect(fetch).toHaveBeenCalledTimes(3)
+    expect(String(fetch.mock.calls[2][0])).toContain('/acl/permissions?limit=1')
+  })
+
+  it('lists deferred pages then base tables and resumes without fetching content', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json({ items: [page], nextPageToken: 'pages-2' }))
+      .mockResolvedValueOnce(Response.json({ items: [] }))
+      .mockResolvedValueOnce(
+        Response.json({ items: [table, { ...table, id: 'view', tableType: 'view' }] })
+      )
+    const first = await codaConnector.listDocuments('token', config)
+    expect(first.documents[0]).toMatchObject({
+      externalId: 'doc-1/pages/canvas-1',
+      contentDeferred: true,
+      content: '',
+      estimatedBytes: 12 * 1024 * 1024,
+    })
+    const second = await codaConnector.listDocuments('token', config, first.nextCursor)
+    const third = await codaConnector.listDocuments('token', config, second.nextCursor)
+    expect(third.documents.map((item) => item.externalId)).toEqual(['doc-1/tables/grid-1'])
+    expect(third.hasMore).toBe(false)
+    expect(String(fetch.mock.calls[2][0])).toBe(
+      'https://coda.io/apis/v1/docs/doc-1/pages?pageToken=pages-2'
+    )
+    expect(fetch.mock.calls.every(([url]) => !String(url).endsWith('/content'))).toBe(true)
+  })
+
+  it('reuses only the current listing document metadata during deferred hydration', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+      .mockResolvedValueOnce(Response.json(page))
+      .mockResolvedValueOnce(Response.json({ items: [line('Cached parent')] }))
+    const context = {}
+    const listed = await codaConnector.listDocuments('token', config, undefined, context)
+    const full = await codaConnector.getDocument(
+      'token',
+      config,
+      listed.documents[0].externalId,
+      context
+    )
+    expect(full?.content).toContain('Cached parent')
+    expect(full?.contentHash).toBe(listed.documents[0].contentHash)
+    expect(
+      fetch.mock.calls.filter(([url]) => String(url) === 'https://coda.io/apis/v1/docs/doc-1')
+    ).toHaveLength(1)
+  })
+
+  it('keeps document discovery separate from child pagination and marks unstable discovery', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({ items: [doc], nextPageToken: 'docs-2' }))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+      .mockResolvedValueOnce(Response.json({ items: [] }))
+      .mockResolvedValueOnce(Response.json({ items: [{ ...doc, id: 'doc-2' }] }))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+    const first = await codaConnector.listDocuments('token', {})
+    const tables = await codaConnector.listDocuments('token', {}, first.nextCursor)
+    const nextDoc = await codaConnector.listDocuments('token', {}, tables.nextCursor)
+    expect(first.reconciliationSafe).toBe(false)
+    expect(nextDoc.documents[0].externalId).toBe('doc-2/pages/canvas-1')
+    expect(String(fetch.mock.calls[3][0])).toBe('https://coda.io/apis/v1/docs?pageToken=docs-2')
+  })
+
+  it('resumes a bounded discovery batch without listing the parent collection per document', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({ items: [doc, { ...doc, id: 'doc-2' }] }))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+      .mockResolvedValueOnce(Response.json({ items: [] }))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+    const first = await codaConnector.listDocuments('token', {})
+    const tables = await codaConnector.listDocuments('token', {}, first.nextCursor)
+    const second = await codaConnector.listDocuments('token', {}, tables.nextCursor)
+    expect(second.documents[0].externalId).toBe('doc-2/pages/canvas-1')
+    expect(fetch.mock.calls.map(([url]) => String(url))).toEqual([
+      'https://coda.io/apis/v1/docs?limit=10',
+      'https://coda.io/apis/v1/docs/doc-1/pages?limit=100',
+      'https://coda.io/apis/v1/docs/doc-1/tables?limit=100',
+      'https://coda.io/apis/v1/docs/doc-2/pages?limit=100',
+    ])
+  })
+
+  it('omits hidden, inherited-hidden, embedded and synced pages', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [
+            page,
+            { ...page, isHidden: true },
+            { ...page, isEffectivelyHidden: true },
+            { ...page, contentType: 'embed' },
+            { ...page, contentType: 'syncPage' },
+          ],
+        })
+      )
+    expect((await codaConnector.listDocuments('token', config)).documents).toHaveLength(1)
+  })
+
+  it('uses the same metadata hash for listing and complete paginated hydration', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json(page))
+      .mockResolvedValueOnce(Response.json({ items: [line('First')], nextPageToken: 'content-2' }))
+      .mockResolvedValueOnce(Response.json({ items: [line('Second')] }))
+    const listed = await codaConnector.listDocuments('token', config)
+    const hydrated = await codaConnector.getDocument(
+      'token',
+      config,
+      listed.documents[0].externalId
+    )
+    expect(hydrated).toMatchObject({
+      contentHash: listed.documents[0].contentHash,
+      contentDeferred: false,
+    })
+    expect(hydrated?.content).toContain('First\n\nSecond')
+  })
+
+  it('retains column identities when names duplicate and fetches every row page', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json(table))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [
+            { id: 'col-1', name: 'Status' },
+            { id: 'col-2', name: 'Status' },
+          ],
+        })
+      )
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [{ name: 'One', values: { 'col-1': false, 'col-2': ['A', 'B'] } }],
+          nextPageToken: 'rows-2',
+        })
+      )
+      .mockResolvedValueOnce(Response.json({ items: [{ name: 'Two', values: { 'col-1': 0 } }] }))
+    const result = await codaConnector.getDocument('token', config, 'doc-1/tables/grid-1')
+    expect(result?.content).toContain('Status: false\nStatus: A, B')
+    expect(result?.content).toContain('Two\nStatus: 0')
+  })
+
+  it('fails incomplete hydration without swallowing authorization errors', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json(page))
+      .mockResolvedValueOnce(Response.json({}, { status: 403 }))
+    await expect(
+      codaConnector.getDocument('token', config, 'doc-1/pages/canvas-1')
+    ).rejects.toMatchObject({ status: 403 })
+  })
+
+  it.each([404, 410])('returns null for an unavailable resource (%s)', async (status) => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(Response.json({}, { status }))
+    await expect(
+      codaConnector.getDocument('token', config, 'doc-1/pages/canvas-1')
+    ).resolves.toBeNull()
+  })
+
+  it('rejects malformed provider lists rather than reconciling them as empty', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(Response.json({}))
+    await expect(codaConnector.listDocuments('token', {})).rejects.toThrow('invalid response')
+  })
+
+  it('rejects repeated content cursors without indexing a partial document', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json(page))
+      .mockResolvedValueOnce(Response.json({ items: [line('One')], nextPageToken: 'same' }))
+      .mockResolvedValueOnce(Response.json({ items: [line('Two')], nextPageToken: 'same' }))
+    await expect(
+      codaConnector.getDocument('token', config, 'doc-1/pages/canvas-1')
+    ).rejects.toThrow('repeated')
+  })
+
+  it('bounds provider response bytes even without a content-length header', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      new Response(' '.repeat(4 * 1024 * 1024 + 1))
+    )
+    await expect(codaConnector.listDocuments('token', {})).rejects.toThrow('4MB')
+  })
+
+  it('rejects unsafe identifiers and out-of-scope hydration before making requests', async () => {
+    const fetch = vi.spyOn(globalThis, 'fetch')
+    expect(await codaConnector.validateConfig('token', { docIds: '../whoami' })).toMatchObject({
+      valid: false,
+    })
+    await expect(codaConnector.getDocument('token', config, '../pages/canvas-1')).rejects.toThrow()
+    await expect(
+      codaConnector.getDocument('token', config, 'other/pages/canvas-1')
+    ).resolves.toBeNull()
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('does not follow provider links or redirects with the token', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        Response.json({ items: [doc], nextPageLink: 'https://evil.example/steal' })
+      )
+      .mockResolvedValueOnce(Response.json({ items: [page] }))
+    await codaConnector.listDocuments('token', {})
+    expect(
+      fetch.mock.calls.every(
+        ([url, options]) =>
+          String(url).startsWith('https://coda.io/apis/v1/') && options?.redirect === 'error'
+      )
+    ).toBe(true)
+  })
+})
diff --git a/apps/sim/connectors/coda/coda.ts b/apps/sim/connectors/coda/coda.ts
new file mode 100644
index 00000000000..13922b47a9b
--- /dev/null
+++ b/apps/sim/connectors/coda/coda.ts
@@ -0,0 +1,437 @@
+import { getErrorMessage } from '@sim/utils/errors'
+import { generateId } from '@sim/utils/id'
+import { z } from 'zod'
+import {
+  type CodaDoc,
+  type CodaResource,
+  codaAdminDocSchema,
+  codaDocSchema,
+  codaEmailSchema,
+  codaIdSchema,
+  codaJson,
+  codaListSchema,
+  codaPageSchema,
+  codaPages,
+  codaPageTokenSchema,
+  codaResourceSchema,
+  codaTableSchema,
+} from '@/connectors/coda/client'
+import { codaOrganizationPath, codaSourceConfig } from '@/connectors/coda/config'
+import { codaConnectorMeta } from '@/connectors/coda/meta'
+import {
+  openCodaDirectory,
+  resolveCodaAcls,
+  validateCodaAdminAccess,
+  validateCodaDocPermissions,
+} from '@/connectors/coda/permissions'
+import { codaDocumentPath, readCodaDoc } from '@/connectors/coda/source'
+import { ConnectorSourceError } from '@/connectors/source-error'
+import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
+import { CONNECTOR_TEXT_DOCUMENT_MAX_BYTES, parseTagDate } from '@/connectors/utils'
+
+const DOC_PAGE_SIZE = 10
+const MAX_CURSOR_LENGTH = 512 * 1024
+const cursorSchema = z.object({
+  version: z.literal(1),
+  docIndex: z.number().int().min(0).max(100),
+  docToken: codaPageTokenSchema.optional(),
+  nextDocToken: codaPageTokenSchema.optional(),
+  doc: codaDocSchema.optional(),
+  pendingDocs: z
+    .array(codaDocSchema)
+    .max(DOC_PAGE_SIZE - 1)
+    .optional(),
+  phase: z.enum(['pages', 'tables']),
+  pageToken: codaPageTokenSchema.optional(),
+  organizationId: codaIdSchema.optional(),
+})
+type CodaCursor = z.infer<typeof cursorSchema>
+type ResourceKind = 'pages' | 'tables'
+const listedDocSchema = z.object({
+  doc: codaDocSchema,
+  organizationId: codaIdSchema.optional(),
+})
+
+function encodeCursor(cursor: CodaCursor): string {
+  const encoded = Buffer.from(JSON.stringify(cursor)).toString('base64url')
+  if (encoded.length > MAX_CURSOR_LENGTH) throw new Error('Coda cursor exceeded its size limit')
+  return encoded
+}
+
+function decodeCursor(value?: string): CodaCursor {
+  if (!value) return { version: 1, docIndex: 0, phase: 'pages' }
+  if (value.length > MAX_CURSOR_LENGTH) throw new Error('Invalid Coda cursor')
+  return cursorSchema.parse(JSON.parse(Buffer.from(value, 'base64url').toString('utf8')))
+}
+
+/** The shared generation ID refreshes exports whose optional Admin revision is absent. */
+function listingToken(context?: Record<string, unknown>): string {
+  if (typeof context?.syncRunId === 'string') return context.syncRunId
+  if (typeof context?._codaListingToken === 'string') return context._codaListingToken
+  const token = generateId()
+  if (context) context._codaListingToken = token
+  return token
+}
+
+/** Doc revisions also invalidate tables when row edits do not update table metadata. */
+function toStub(
+  doc: CodaDoc,
+  resource: CodaResource,
+  kind: ResourceKind,
+  context?: Record<string, unknown>
+): ExternalDocument {
+  return {
+    externalId: `${doc.id}/${kind}/${resource.id}`,
+    title: `${doc.name} / ${resource.name}`,
+    content: '',
+    contentDeferred: true,
+    estimatedBytes: CONNECTOR_TEXT_DOCUMENT_MAX_BYTES,
+    mimeType: 'text/plain',
+    sourceUrl: resource.browserLink,
+    contentHash: `coda:${JSON.stringify([doc.id, kind, resource.id, doc.updatedAt ?? `run:${listingToken(context)}`, doc.name, resource.name])}`,
+    metadata: {
+      docId: doc.id,
+      document: doc.name,
+      resourceType: kind,
+      lastModified: doc.updatedAt,
+    },
+  }
+}
+
+function parseExternalId(externalId: string): {
+  docId: string
+  kind: ResourceKind
+  resourceId: string
+} {
+  const [docId, kind, resourceId, extra] = externalId.split('/')
+  if (extra !== undefined || (kind !== 'pages' && kind !== 'tables')) {
+    throw new Error('Invalid Coda document ID')
+  }
+  return { docId: codaIdSchema.parse(docId), kind, resourceId: codaIdSchema.parse(resourceId) }
+}
+
+function nextDocument(state: CodaCursor, docIds: string[]): CodaCursor | undefined {
+  if (docIds.length > 0) {
+    return state.docIndex + 1 < docIds.length
+      ? { version: 1, docIndex: state.docIndex + 1, phase: 'pages' }
+      : undefined
+  }
+  if (state.pendingDocs?.length) {
+    return {
+      version: 1,
+      docIndex: 0,
+      phase: 'pages',
+      doc: state.pendingDocs[0],
+      pendingDocs: state.pendingDocs.slice(1),
+      nextDocToken: state.nextDocToken,
+    }
+  }
+  return state.nextDocToken
+    ? { version: 1, docIndex: 0, phase: 'pages', docToken: state.nextDocToken }
+    : undefined
+}
+
+async function listDocuments(
+  token: string,
+  sourceConfig: Record<string, unknown>,
+  cursor?: string,
+  context?: Record<string, unknown>
+): Promise<ExternalDocumentList> {
+  const { docIds, organizationId } = codaSourceConfig(sourceConfig, context)
+  const admin = Boolean(organizationId)
+  const root = organizationId ? codaOrganizationPath(organizationId, 'docs') : '/docs'
+  const state = decodeCursor(cursor)
+  if (cursor && state.organizationId !== organizationId)
+    throw new Error('Coda cursor belongs to a different source')
+  state.organizationId = organizationId
+  if (admin && state.phase === 'tables') throw new Error('Invalid Coda organization cursor')
+  if (state.doc && docIds.length && state.doc.id !== docIds[state.docIndex]) {
+    throw new Error('Coda cursor belongs to a different document scope')
+  }
+  if (!state.doc) {
+    if (docIds.length) {
+      const docId = docIds[state.docIndex]
+      if (!docId) throw new Error('Invalid Coda document cursor')
+      try {
+        state.doc = await readCodaDoc(token, docId, organizationId)
+      } catch (error) {
+        if (!(error instanceof ConnectorSourceError && [404, 410].includes(error.status)))
+          throw error
+        const next = nextDocument(state, docIds)
+        return {
+          documents: [],
+          hasMore: Boolean(next),
+          nextCursor: next && encodeCursor({ ...next, organizationId }),
+          reconciliationSafe: true,
+        }
+      }
+    } else {
+      const listed = await codaJson(
+        token,
+        root,
+        codaListSchema(admin ? codaAdminDocSchema : codaDocSchema),
+        {
+          limit: DOC_PAGE_SIZE,
+          pageToken: state.docToken,
+          ...(admin ? { docAvailabilityState: 'online', fetchPermissionsMode: 'none' } : {}),
+        },
+        false,
+        admin
+      )
+      if (listed.items.length > DOC_PAGE_SIZE)
+        throw new Error('Coda ignored the document page size')
+      if (listed.nextPageToken && listed.nextPageToken === state.docToken) {
+        throw new Error('Coda repeated a document pagination token')
+      }
+      state.doc = listed.items[0]
+      state.pendingDocs = listed.items.slice(1)
+      state.nextDocToken = listed.nextPageToken
+      if (!state.doc) {
+        const next = nextDocument(state, docIds)
+        return {
+          documents: [],
+          hasMore: Boolean(next),
+          nextCursor: next && encodeCursor({ ...next, organizationId }),
+          reconciliationSafe: false,
+        }
+      }
+    }
+  }
+
+  const currentCursor = encodeCursor(state)
+  if (state.doc.isDeleted || state.doc.keyAccessRevoked) {
+    const next = nextDocument(state, docIds)
+    return {
+      documents: [],
+      hasMore: Boolean(next),
+      nextCursor: next && encodeCursor({ ...next, organizationId }),
+      reconciliationSafe: docIds.length > 0,
+    }
+  }
+  if (context) context._codaListedDoc = { doc: state.doc, organizationId }
+  const path = `${codaDocumentPath(state.doc, organizationId)}/${state.phase}`
+  const schema = admin
+    ? codaResourceSchema
+    : state.phase === 'pages'
+      ? codaPageSchema
+      : codaTableSchema
+  const listed = await codaJson(
+    token,
+    path,
+    codaListSchema(schema),
+    {
+      limit: 100,
+      pageToken: state.pageToken,
+    },
+    false,
+    admin
+  )
+  if (listed.nextPageToken && listed.nextPageToken === state.pageToken) {
+    throw new Error('Coda repeated a resource pagination token')
+  }
+  const doc = state.doc
+  const documents = listed.items
+    .filter(
+      (item) =>
+        admin ||
+        ('contentType' in item
+          ? item.contentType === 'canvas' &&
+            'isHidden' in item &&
+            item.isHidden === false &&
+            'isEffectivelyHidden' in item &&
+            item.isEffectivelyHidden === false
+          : 'tableType' in item && item.tableType === 'table')
+    )
+    .map((item) => toStub(doc, item, state.phase, context))
+  const next: CodaCursor | undefined = listed.nextPageToken
+    ? { ...state, pageToken: listed.nextPageToken }
+    : state.phase === 'pages' && !admin
+      ? { ...state, phase: 'tables', pageToken: undefined }
+      : nextDocument(state, docIds)
+  return {
+    documents,
+    currentCursor,
+    hasMore: Boolean(next),
+    nextCursor: next && encodeCursor({ ...next, organizationId }),
+    /** Coda sorts discovered docs by user activity and does not promise a snapshot. */
+    reconciliationSafe: docIds.length > 0,
+  }
+}
+
+const lineSchema = z.object({
+  type: z.literal('line'),
+  itemContent: z.object({ format: z.literal('plainText'), content: z.string() }).optional(),
+})
+const columnSchema = z.object({ id: codaIdSchema, name: z.string().max(4096) })
+const cellSchema = z.union([z.string(), z.number(), z.boolean(), z.null()])
+const rowSchema = z.object({
+  name: z.string(),
+  values: z.record(z.string(), z.union([cellSchema, z.array(cellSchema)])),
+})
+
+/** Throws instead of indexing a truncated page or table as though it were complete. */
+class CodaText {
+  private readonly parts: string[] = []
+  private bytes = 0
+
+  append(text: string): void {
+    this.bytes += Buffer.byteLength(text, 'utf8') + 2
+    if (this.bytes > CONNECTOR_TEXT_DOCUMENT_MAX_BYTES) {
+      throw new Error('Coda content exceeded the 12MB limit')
+    }
+    this.parts.push(text)
+  }
+
+  toString(): string {
+    return this.parts.join('\n\n')
+  }
+}
+
+async function getDocument(
+  token: string,
+  sourceConfig: Record<string, unknown>,
+  externalId: string,
+  context?: Record<string, unknown>
+) {
+  const { docIds, organizationId } = codaSourceConfig(sourceConfig, context)
+  const { docId, kind, resourceId } = parseExternalId(externalId)
+  if (docIds.length > 0 && !docIds.includes(docId)) return null
+  try {
+    const cached = listedDocSchema.safeParse(context?._codaListedDoc)
+    const doc =
+      cached.success &&
+      cached.data.organizationId === organizationId &&
+      cached.data.doc.id === docId
+        ? cached.data.doc
+        : await readCodaDoc(token, docId, organizationId)
+    const path = `${codaDocumentPath(doc, organizationId)}/${kind}/${encodeURIComponent(resourceId)}`
+    if (doc.isDeleted || doc.keyAccessRevoked) return null
+    if (organizationId) {
+      if (kind !== 'pages') return null
+      const page = await codaJson(
+        token,
+        path,
+        codaResourceSchema.extend({
+          pageContent: z.object({ content: z.string() }),
+        }),
+        { outputFormat: 'LossyPlainText' },
+        false,
+        true
+      )
+      if (page.id !== resourceId) throw new Error('Coda returned a different page')
+      const text = new CodaText()
+      text.append(`${doc.name}\n${page.name}`)
+      text.append(page.pageContent.content)
+      return {
+        ...toStub(doc, page, kind, context),
+        content: text.toString(),
+        contentDeferred: false,
+      }
+    }
+    const resource = await codaJson(
+      token,
+      path,
+      kind === 'pages' ? codaPageSchema : codaTableSchema
+    )
+    if (resource.id !== resourceId) throw new Error('Coda returned a different resource')
+    if ('contentType' in resource) {
+      if (resource.contentType !== 'canvas' || resource.isHidden || resource.isEffectivelyHidden) {
+        return null
+      }
+    } else if (resource.tableType !== 'table') return null
+    const text = new CodaText()
+    text.append(`${doc.name}\n${resource.name}`)
+    if (kind === 'pages') {
+      for await (const items of codaPages(token, `${path}/content`, lineSchema, {
+        contentFormat: 'plainText',
+      })) {
+        for (const item of items) if (item.itemContent) text.append(item.itemContent.content)
+      }
+    } else {
+      const columns = new Map<string, string>()
+      for await (const items of codaPages(token, `${path}/columns`, columnSchema)) {
+        for (const column of items) {
+          if (columns.size >= 1000) throw new Error('Coda table exceeded the 1000-column limit')
+          columns.set(column.id, column.name)
+        }
+      }
+      for await (const items of codaPages(token, `${path}/rows`, rowSchema, {
+        valueFormat: 'simple',
+      })) {
+        for (const row of items) {
+          text.append(
+            [
+              row.name,
+              ...Object.entries(row.values).map(([id, value]) => {
+                const rendered = Array.isArray(value) ? value.join(', ') : String(value ?? '')
+                return `${columns.get(id) ?? id}: ${rendered}`
+              }),
+            ].join('\n')
+          )
+        }
+      }
+    }
+    return {
+      ...toStub(doc, resource, kind, context),
+      content: text.toString(),
+      contentDeferred: false,
+    }
+  } catch (error) {
+    if (error instanceof ConnectorSourceError && (error.status === 404 || error.status === 410)) {
+      return null
+    }
+    throw error
+  }
+}
+
+export const codaConnector: ConnectorConfig = {
+  ...codaConnectorMeta,
+  contentConcurrency: 2,
+  listDocuments,
+  getDocument,
+  getDocumentAcls: resolveCodaAcls,
+  openDirectory: async (token, config, context) => {
+    const { organizationId } = codaSourceConfig(config, context)
+    return organizationId ? openCodaDirectory(token, organizationId) : null
+  },
+  validateConfig: async (token, sourceConfig, context) => {
+    try {
+      const { docIds, organizationId } = codaSourceConfig(sourceConfig, context)
+      await codaJson(token, '/whoami', z.object({ loginId: codaEmailSchema }), undefined, true)
+      if (organizationId) await validateCodaAdminAccess(token, organizationId)
+      const root = organizationId ? codaOrganizationPath(organizationId, 'docs') : '/docs'
+      let probeDoc: CodaDoc | undefined
+      const firstDocId = docIds[0]
+      if (firstDocId) {
+        probeDoc = await readCodaDoc(token, firstDocId, organizationId, true)
+      } else {
+        const docs = await codaJson(
+          token,
+          root,
+          codaListSchema(organizationId ? codaAdminDocSchema : codaDocSchema),
+          {
+            limit: 1,
+            ...(organizationId
+              ? { fetchPermissionsMode: 'none', docAvailabilityState: 'online' }
+              : {}),
+          },
+          true,
+          Boolean(organizationId)
+        )
+        probeDoc = docs.items[0]
+      }
+      if (context?.mirrorsSourceAcls === true && probeDoc)
+        await validateCodaDocPermissions(token, probeDoc, organizationId)
+      return { valid: true }
+    } catch (error) {
+      return { valid: false, error: getErrorMessage(error, 'Unable to connect to Coda') }
+    }
+  },
+  isCredentialInvalidError: (error) =>
+    error instanceof ConnectorSourceError && error.status === 401,
+  mapTags: (metadata) => ({
+    document: metadata.document,
+    resourceType: metadata.resourceType,
+    lastModified: parseTagDate(metadata.lastModified),
+  }),
+}
diff --git a/apps/sim/connectors/coda/config.ts b/apps/sim/connectors/coda/config.ts
new file mode 100644
index 00000000000..ed3fef080b7
--- /dev/null
+++ b/apps/sim/connectors/coda/config.ts
@@ -0,0 +1,29 @@
+import { z } from 'zod'
+import { codaIdSchema } from '@/connectors/coda/client'
+import { parseMultiValue } from '@/connectors/utils'
+import { codaPath } from '@/tools/coda/utils'
+
+const configSchema = z.object({
+  docIds: z.union([z.string(), z.array(z.string())]).optional(),
+  organizationId: z.string().optional(),
+})
+
+export function codaSourceConfig(
+  config: Record<string, unknown>,
+  context?: Record<string, unknown>
+) {
+  const parsed = configSchema.parse(config)
+  const docIds = z.array(codaIdSchema).max(100).parse(parseMultiValue(parsed.docIds))
+  const organizationId =
+    context?.mirrorsSourceAcls === true && parsed.organizationId?.trim()
+      ? codaIdSchema.parse(parsed.organizationId.trim())
+      : undefined
+  return { docIds, organizationId }
+}
+
+export function codaOrganizationPath(
+  organizationId: string,
+  ...segments: Array<string | [string, string]>
+) {
+  return codaPath('organizations', [organizationId, 'organizationId'], ...segments)
+}
diff --git a/apps/sim/connectors/coda/index.ts b/apps/sim/connectors/coda/index.ts
new file mode 100644
index 00000000000..eefd5354bf2
--- /dev/null
+++ b/apps/sim/connectors/coda/index.ts
@@ -0,0 +1 @@
+export { codaConnector } from '@/connectors/coda/coda'
diff --git a/apps/sim/connectors/coda/meta.ts b/apps/sim/connectors/coda/meta.ts
new file mode 100644
index 00000000000..4c0ae001dd0
--- /dev/null
+++ b/apps/sim/connectors/coda/meta.ts
@@ -0,0 +1,68 @@
+import { CodaIcon } from '@/components/icons'
+import type { ConnectorMeta } from '@/connectors/types'
+
+export const codaConnectorMeta: ConnectorMeta = {
+  id: 'coda',
+  name: 'Coda',
+  description: 'Sync Coda pages and tables',
+  version: '1.0.0',
+  icon: CodaIcon,
+  search: true,
+  searchDocsUrl: 'https://docs.sim.ai/search/coda',
+  supportedAccessModes: ['admin', 'workspace'],
+  auth: {
+    mode: 'oauth',
+    provider: 'coda',
+    requiredScopes: [],
+    adminCredentialType: 'service_account',
+  },
+  mirrorsSourceAcls: true,
+  adminSetupHint:
+    'Use a Coda API token that can read the documents and their sharing permissions. Direct shares match verified Sim email addresses. An Enterprise org-admin token and organization ID are needed for organization-wide discovery and group, workspace, or domain grants. Link-only shares do not grant search access.',
+  rehydrateOnFullSync: true,
+  configFields: [
+    {
+      id: 'docSelector',
+      title: 'Documents',
+      type: 'selector',
+      selectorKey: 'coda.docs',
+      canonicalParamId: 'docIds',
+      mode: 'basic',
+      multi: true,
+      required: false,
+      preserveValueOnModeChange: true,
+      placeholder: 'All accessible, previously opened documents',
+      descriptionInAdminMode:
+        'The picker shows documents the token owner can access and has opened. Switch to document IDs for other Enterprise organization documents.',
+    },
+    {
+      id: 'docIds',
+      title: 'Document IDs',
+      type: 'short-input',
+      canonicalParamId: 'docIds',
+      mode: 'advanced',
+      multi: true,
+      required: false,
+      preserveValueOnModeChange: true,
+      placeholder: 'Leave empty to discover documents',
+      description: 'Explicit IDs also include accessible documents the token owner has not opened.',
+      descriptionInAdminMode:
+        'Leave empty for discovery, or enter document IDs. Without an organization ID, discovery only includes documents the token owner has opened.',
+    },
+    {
+      id: 'organizationId',
+      title: 'Enterprise organization ID',
+      type: 'short-input',
+      showInAdminModeOnly: true,
+      required: false,
+      placeholder: 'org-… (optional)',
+      description:
+        'Requires a Coda Enterprise organization administrator. Enables organization-wide page indexing and directory permissions. Leave empty for token-accessible pages and tables with direct email shares.',
+    },
+  ],
+  tagDefinitions: [
+    { id: 'document', displayName: 'Document', fieldType: 'text' },
+    { id: 'resourceType', displayName: 'Resource Type', fieldType: 'text' },
+    { id: 'lastModified', displayName: 'Last Modified', fieldType: 'date' },
+  ],
+}
diff --git a/apps/sim/connectors/coda/permissions.test.ts b/apps/sim/connectors/coda/permissions.test.ts
new file mode 100644
index 00000000000..8a99b84d544
--- /dev/null
+++ b/apps/sim/connectors/coda/permissions.test.ts
@@ -0,0 +1,287 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { codaConnector } from '@/connectors/coda/coda'
+import {
+  codaPermissionTokens,
+  openCodaDirectory,
+  resolveCodaAcls,
+} from '@/connectors/coda/permissions'
+import type { ExternalDocument } from '@/connectors/types'
+
+const doc = {
+  id: 'doc-1',
+  name: 'Doc',
+  browserLink: 'https://coda.io/d/_ddoc-1',
+  updatedAt: '2026-09-16T00:00:00Z',
+  owner: 'owner@example.com',
+  workspaceId: 'ws-1',
+}
+const stub: ExternalDocument = {
+  externalId: 'doc-1/pages/canvas-1',
+  title: 'Page',
+  content: '',
+  contentHash: 'same',
+  mimeType: 'text/plain',
+}
+let admin: Record<string, unknown> = { mirrorsSourceAcls: true }
+
+describe('Coda source permissions', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks()
+    admin = { mirrorsSourceAcls: true }
+  })
+
+  it('keeps case-sensitive Coda group IDs distinct after shared group normalization', () => {
+    const tokens = codaPermissionTokens(
+      [
+        { access: 'readonly', principal: { type: 'group', groupId: 'grp-X' } },
+        { access: 'readonly', principal: { type: 'group', groupId: 'grp-x' } },
+      ],
+      undefined,
+      'org-1'
+    )
+    expect(tokens).toEqual(['g:coda:org-1:group:6772702d58', 'g:coda:org-1:group:6772702d78'])
+  })
+
+  it('maps direct grants and ownership but never broadens link, domain, workspace, or unknown access', () => {
+    expect(
+      codaPermissionTokens(
+        [
+          { access: 'readonly', principal: { type: 'email', email: 'Reader@Example.com' } },
+          { access: 'comment', principal: { type: 'email', email: 'comment@example.com' } },
+          { access: 'none', principal: { type: 'email', email: 'denied@example.com' } },
+          { access: 'future-access', principal: { type: 'email', email: 'unknown@example.com' } },
+          { access: 'write', principal: { type: 'anyone' } },
+          { access: 'readonly', principal: { type: 'domain', domain: 'example.com' } },
+          { access: 'readonly', principal: { type: 'workspace', workspaceId: 'ws-1' } },
+          { access: 'readonly', principal: { type: 'group', groupId: 'grp-1' } },
+          { access: 'readonly', principal: { type: 'internalAccess' } },
+        ],
+        doc.owner
+      )
+    ).toEqual(['link', 'u:comment@example.com', 'u:owner@example.com', 'u:reader@example.com'])
+  })
+
+  it('namespaces Enterprise grants and gates registered users through directory status', () => {
+    expect(
+      codaPermissionTokens(
+        [
+          { access: 'write', principal: { type: 'email', email: 'Reader@Example.com' } },
+          { access: 'readonly', principal: { type: 'domain', domain: 'Example.COM' } },
+          { access: 'readonly', principal: { type: 'workspace', workspaceId: 'ws-1' } },
+          { access: 'readonly', principal: { type: 'group', groupId: 'grp-1' } },
+        ],
+        undefined,
+        'org-1'
+      )
+    ).toEqual([
+      'g:coda:org-1:domain:example.com',
+      'g:coda:org-1:group:6772702d31',
+      'g:coda:org-1:user:reader@example.com',
+      'g:coda:org-1:workspace:77732d31',
+    ])
+  })
+
+  it('refreshes sharing for unchanged pages and tables, including every ACL page', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [
+            { access: 'readonly', principal: { type: 'email', email: 'reader@example.com' } },
+          ],
+          nextPageToken: 'next',
+        })
+      )
+      .mockResolvedValueOnce(Response.json({ items: [] }))
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(Response.json({ items: [] }))
+    const documents = [stub, { ...stub, externalId: 'doc-1/tables/grid-1' }]
+    const before = await resolveCodaAcls('token', {}, documents, admin)
+    expect(before[stub.externalId]).toContain('u:reader@example.com')
+    expect(before[documents[1].externalId]).toEqual(before[stub.externalId])
+    const after = await resolveCodaAcls('token', {}, documents, admin)
+    expect(after[stub.externalId]).toEqual(['u:owner@example.com'])
+    expect(fetch).toHaveBeenCalledTimes(5)
+  })
+
+  it('fails closed on an incomplete ACL instead of retaining the successfully read prefix', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json(doc))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [
+            { access: 'readonly', principal: { type: 'email', email: 'reader@example.com' } },
+          ],
+          nextPageToken: 'next',
+        })
+      )
+      .mockResolvedValueOnce(Response.json({}, { status: 403 }))
+    expect(await resolveCodaAcls('token', {}, [stub], admin)).toEqual({})
+  })
+
+  it('ignores untrusted metadata doc IDs and refuses documents outside the selected scope', async () => {
+    const fetch = vi.spyOn(globalThis, 'fetch')
+    expect(
+      await resolveCodaAcls(
+        'token',
+        { docIds: ['other'] },
+        [{ ...stub, metadata: { docId: 'other' } }],
+        admin
+      )
+    ).toEqual({})
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('opens the Enterprise directory lazily and excludes deactivated or deleted users', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [
+            { email: 'active@example.com', status: 'Active' },
+            { email: 'disabled@example.com', status: 'Deactivated' },
+            { email: 'deleted@example.com', status: 'Deleted' },
+          ],
+        })
+      )
+      .mockResolvedValueOnce(Response.json({ items: [{ id: 'grp-X' }] }))
+      .mockResolvedValueOnce(Response.json({ items: [{ id: 'ws-X' }] }))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [{ email: 'active@example.com' }, { email: 'disabled@example.com' }],
+          nextPageToken: 'members-2',
+        })
+      )
+      .mockResolvedValueOnce(Response.json({ items: [{ email: 'guest@external.com' }] }))
+    const directory = openCodaDirectory('token', 'org-1')
+    expect(fetch).not.toHaveBeenCalled()
+    const groups = await directory.listGroups()
+    expect(groups).toContainEqual({ id: 'domain:example.com' })
+    expect(
+      (await directory.listGroupMembers({ id: 'user:disabled@example.com' })).memberTokens
+    ).toEqual([])
+    expect((await directory.listGroupMembers({ id: 'domain:example.com' })).memberTokens).toEqual([
+      'u:active@example.com',
+    ])
+    expect((await directory.listGroupMembers({ id: 'group:6772702d58' })).memberTokens).toEqual([
+      'u:active@example.com',
+      'u:guest@external.com',
+    ])
+    expect(String(fetch.mock.calls[4][0])).toBe(
+      'https://coda.io/apis/admin/v1/organizations/org-1/groups/grp-X/members?pageToken=members-2'
+    )
+  })
+
+  it('throws on malformed or partial directories instead of replacing memberships', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      Response.json({ items: [{ email: 'bad' }] })
+    )
+    await expect(openCodaDirectory('token', 'org-1').listGroups()).rejects.toThrow(
+      'invalid response'
+    )
+  })
+
+  it('uses the Admin API only for mirrored access with an explicit organization', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({ items: [doc] }))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [{ id: 'canvas-1', name: 'Page', browserLink: 'https://coda.io/d/page' }],
+        })
+      )
+
+      .mockResolvedValueOnce(
+        Response.json({
+          id: 'canvas-1',
+          name: 'Page',
+          browserLink: 'https://coda.io/d/page',
+          pageContent: { content: 'Admin page body' },
+        })
+      )
+    const config = { docIds: ['doc-1'], organizationId: 'org-1' }
+    const listed = await codaConnector.listDocuments('token', config, undefined, admin)
+    expect(listed.hasMore).toBe(false)
+    const full = await codaConnector.getDocument(
+      'token',
+      config,
+      listed.documents[0].externalId,
+      admin
+    )
+    expect(full?.content).toContain('Admin page body')
+    expect(full?.contentHash).toBe(listed.documents[0].contentHash)
+    expect(fetch.mock.calls.map(([url]) => String(url))).toEqual([
+      'https://coda.io/apis/admin/v1/organizations/org-1/docs?docIds=doc-1&limit=1&fetchPermissionsMode=none',
+      'https://coda.io/apis/admin/v1/organizations/org-1/workspaces/ws-1/docs/doc-1/pages?limit=100',
+      'https://coda.io/apis/admin/v1/organizations/org-1/workspaces/ws-1/docs/doc-1/pages/canvas-1?outputFormat=LossyPlainText',
+    ])
+  })
+
+  it('refreshes unversioned Enterprise pages once per durable sync generation', async () => {
+    const { updatedAt: _revision, ...unversionedDoc } = doc
+    const page = { id: 'canvas-1', name: 'Page', browserLink: 'https://coda.io/d/page' }
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+      const url = new URL(String(input))
+      if (url.searchParams.has('docIds')) return Response.json({ items: [unversionedDoc] })
+      if (url.pathname.endsWith('/pages')) return Response.json({ items: [page] })
+      return Response.json({ ...page, pageContent: { content: 'Unversioned body' } })
+    })
+    const config = { docIds: ['doc-1'], organizationId: 'org-1' }
+    const context = { ...admin, syncRunId: 'first' }
+    const first = await codaConnector.listDocuments('token', config, undefined, context)
+    const hydrated = await codaConnector.getDocument(
+      'token',
+      config,
+      first.documents[0].externalId,
+      context
+    )
+    expect(hydrated?.contentHash).toBe(first.documents[0].contentHash)
+    const next = await codaConnector.listDocuments('token', config, undefined, {
+      ...admin,
+      syncRunId: 'next',
+    })
+    expect(next.documents[0].contentHash).not.toBe(first.documents[0].contentHash)
+  })
+
+  it('uses current workspace-qualified permissions and rejects ambiguous metadata lookups', async () => {
+    const fetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({ items: [doc] }))
+      .mockResolvedValueOnce(
+        Response.json({
+          items: [{ access: 'readonly', principal: { type: 'workspace', workspaceId: 'ws-1' } }],
+        })
+      )
+      .mockResolvedValueOnce(Response.json({ items: [doc], nextPageToken: 'unexpected' }))
+    const config = { docIds: ['doc-1'], organizationId: 'org-1' }
+    expect((await resolveCodaAcls('token', config, [stub], admin))[stub.externalId]).toContain(
+      'g:coda:org-1:workspace:77732d31'
+    )
+    expect(String(fetch.mock.calls[1][0])).toBe(
+      'https://coda.io/apis/admin/v1/organizations/org-1/workspaces/ws-1/docs/doc-1/acl/permissions?limit=100'
+    )
+    expect(await resolveCodaAcls('token', config, [stub], admin)).toEqual({})
+  })
+
+  it('rejects organization cursors after a scope change', async () => {
+    vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(Response.json({ items: [doc] }))
+      .mockResolvedValueOnce(Response.json({ items: [], nextPageToken: 'more' }))
+    const listed = await codaConnector.listDocuments(
+      'token',
+      { docIds: ['doc-1'], organizationId: 'org-1' },
+      undefined,
+      admin
+    )
+    await expect(
+      codaConnector.listDocuments(
+        'token',
+        { docIds: ['doc-1'], organizationId: 'org-2' },
+        listed.nextCursor,
+        admin
+      )
+    ).rejects.toThrow('different source')
+  })
+})
diff --git a/apps/sim/connectors/coda/permissions.ts b/apps/sim/connectors/coda/permissions.ts
new file mode 100644
index 00000000000..9676c760a3c
--- /dev/null
+++ b/apps/sim/connectors/coda/permissions.ts
@@ -0,0 +1,251 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { z } from 'zod'
+import { groupToken, sortAccessTokens, userToken } from '@/lib/knowledge/access/tokens'
+import { LINK_ACCESS_TOKEN } from '@/lib/knowledge/access/types'
+import {
+  type CodaDoc,
+  codaEmailSchema,
+  codaIdSchema,
+  codaJson,
+  codaListSchema,
+  codaPages,
+} from '@/connectors/coda/client'
+import { codaOrganizationPath, codaSourceConfig } from '@/connectors/coda/config'
+import { codaDocumentPath, readCodaDoc } from '@/connectors/coda/source'
+import type {
+  ConnectorConfig,
+  ConnectorDirectory,
+  ConnectorDirectoryGroup,
+} from '@/connectors/types'
+
+const logger = createLogger('CodaPermissions')
+const MAX_DIRECTORY_ENTRIES = 100_000
+const permissionSchema = z.object({
+  access: z.string().max(64),
+  principal: z.object({
+    type: z.string().max(64),
+    email: codaEmailSchema.optional(),
+    groupId: codaIdSchema.optional(),
+    workspaceId: codaIdSchema.optional(),
+    domain: z.string().max(253).optional(),
+  }),
+})
+const namedSchema = z.object({ id: codaIdSchema })
+const memberSchema = z.object({ email: codaEmailSchema })
+const orgUserSchema = memberSchema.extend({ status: z.enum(['Active', 'Deactivated', 'Deleted']) })
+
+function directoryToken(organizationId: string, id: string): string {
+  const token = groupToken({ providerId: 'coda', tenantId: organizationId, groupId: id })
+  if (!token) throw new Error('Coda returned an invalid permission principal')
+  return token
+}
+
+/**
+ * Link possession and unsupported audiences never become workspace-wide grants.
+ * Opaque Coda IDs use hex so shared email-oriented group normalization cannot merge case-distinct IDs.
+ */
+export function codaPermissionTokens(
+  permissions: readonly z.infer<typeof permissionSchema>[],
+  owner?: string,
+  organizationId?: string
+): string[] {
+  const tokens = new Set<string>()
+  const addPerson = (email?: string) => {
+    const token = userToken(email)
+    if (token)
+      tokens.add(organizationId ? directoryToken(organizationId, `user:${token.slice(2)}`) : token)
+  }
+  addPerson(owner)
+  for (const { access, principal } of permissions) {
+    if (!['readonly', 'comment', 'write'].includes(access)) continue
+    if (principal.type === 'email') addPerson(principal.email)
+    else if (principal.type === 'anyone') tokens.add(LINK_ACCESS_TOKEN)
+    else if (organizationId) {
+      const id =
+        principal.type === 'group' && principal.groupId
+          ? `group:${Buffer.from(principal.groupId).toString('hex')}`
+          : principal.type === 'workspace' && principal.workspaceId
+            ? `workspace:${Buffer.from(principal.workspaceId).toString('hex')}`
+            : principal.type === 'domain' && principal.domain
+              ? `domain:${principal.domain.toLowerCase()}`
+              : undefined
+      if (id) tokens.add(directoryToken(organizationId, id))
+    }
+  }
+  return sortAccessTokens(tokens)
+}
+
+/** Reads the entire ACL afresh even when the document body has not changed. */
+export async function readCodaDocAcl(token: string, docId: string, organizationId?: string) {
+  const doc = await readCodaDoc(token, docId, organizationId)
+  const path = codaDocumentPath(doc, organizationId)
+  if (doc.isDeleted || doc.keyAccessRevoked) return []
+  const permissions: z.infer<typeof permissionSchema>[] = []
+  for await (const page of codaPages(
+    token,
+    `${path}/acl/permissions`,
+    permissionSchema,
+    undefined,
+    Boolean(organizationId)
+  )) {
+    if (permissions.length + page.length > 5000)
+      throw new Error('Coda document exceeded the permission limit')
+    permissions.push(...page)
+  }
+  return codaPermissionTokens(permissions, doc.owner, organizationId)
+}
+
+export const resolveCodaAcls: NonNullable<ConnectorConfig['getDocumentAcls']> = async (
+  token,
+  config,
+  documents,
+  context
+) => {
+  const { docIds, organizationId } = codaSourceConfig(config, context)
+  const groups = new Map<string, string[]>()
+  for (const document of documents) {
+    const docId = document.externalId.split('/')[0]
+    if (!codaIdSchema.safeParse(docId).success || (docIds.length && !docIds.includes(docId)))
+      continue
+    const entries = groups.get(docId) ?? []
+    entries.push(document.externalId)
+    groups.set(docId, entries)
+  }
+  const result: Record<string, string[]> = {}
+  for (const [docId, externalIds] of groups) {
+    try {
+      const acl = await readCodaDocAcl(token, docId, organizationId)
+      for (const externalId of externalIds) result[externalId] = acl
+    } catch (error) {
+      logger.warn('Coda document permissions could not be verified', {
+        docId,
+        error: getErrorMessage(error),
+      })
+    }
+  }
+  return result
+}
+
+/** Admin-only preflight keeps source setup from silently falling back to personal discovery. */
+export async function validateCodaAdminAccess(token: string, organizationId: string) {
+  const root = codaOrganizationPath(organizationId)
+  const organization = await codaJson(token, root, namedSchema, undefined, true, true)
+  if (organization.id !== organizationId) throw new Error('Coda returned a different organization')
+  for (const collection of ['groups', 'workspaces', 'users'] as const) {
+    await codaJson(
+      token,
+      `${root}/${collection}`,
+      codaListSchema(collection === 'users' ? orgUserSchema : namedSchema),
+      { limit: 1 },
+      true,
+      true
+    )
+  }
+}
+
+/** Opens without reading memberships; snapshots are collected only under the directory lease. */
+export function openCodaDirectory(token: string, organizationId: string): ConnectorDirectory {
+  const root = codaOrganizationPath(organizationId)
+  let people: Map<string, boolean> | undefined
+  const domains = new Map<string, string[]>()
+
+  async function readPeople() {
+    const result = new Map<string, boolean>()
+    for await (const page of codaPages(token, `${root}/users`, orgUserSchema, undefined, true)) {
+      for (const person of page) {
+        if (result.size >= MAX_DIRECTORY_ENTRIES)
+          throw new Error('Coda directory exceeded its user limit')
+        const email = person.email.trim().toLowerCase()
+        /** A duplicate identity with conflicting status is never activated by response order. */
+        result.set(email, (result.get(email) ?? true) && person.status === 'Active')
+      }
+    }
+    domains.clear()
+    for (const [email, active] of result) {
+      const domain = email.split('@')[1]
+      const members = domains.get(domain) ?? []
+      if (active) members.push(email)
+      domains.set(domain, members)
+    }
+    people = result
+    return result
+  }
+
+  return {
+    providerId: 'coda',
+    tenantId: organizationId,
+    listGroups: async () => {
+      const users = await readPeople()
+      const groups: ConnectorDirectoryGroup[] = []
+      const append = (id: string) => {
+        if (groups.length >= MAX_DIRECTORY_ENTRIES)
+          throw new Error('Coda directory exceeded its group limit')
+        groups.push({ id })
+      }
+      for (const email of users.keys()) append(`user:${email}`)
+      for (const domain of domains.keys()) append(`domain:${domain}`)
+      for (const [collection, prefix] of [
+        ['groups', 'group'],
+        ['workspaces', 'workspace'],
+      ] as const) {
+        for await (const page of codaPages(
+          token,
+          `${root}/${collection}`,
+          namedSchema,
+          undefined,
+          true
+        )) {
+          for (const group of page) append(`${prefix}:${Buffer.from(group.id).toString('hex')}`)
+        }
+      }
+      return groups
+    },
+    listGroupMembers: async (group) => {
+      const users = people ?? (await readPeople())
+      const memberTokens = new Set<string>()
+      const add = (email: string) => {
+        const normalized = email.trim().toLowerCase()
+        if (users.get(normalized) === false) return
+        const token = userToken(normalized)
+        if (!token) throw new Error('Coda returned an invalid directory member')
+        if (memberTokens.size >= MAX_DIRECTORY_ENTRIES)
+          throw new Error('Coda group exceeded its member limit')
+        memberTokens.add(token)
+      }
+      const separator = group.id.indexOf(':')
+      const kind = group.id.slice(0, separator)
+      const id = group.id.slice(separator + 1)
+      if (kind === 'user') {
+        if (users.get(id) === true) add(id)
+      } else if (kind === 'domain') {
+        for (const email of domains.get(id) ?? []) add(email)
+      } else if (kind === 'group' || kind === 'workspace') {
+        if (!/^(?:[0-9a-f]{2})+$/.test(id)) throw new Error('Invalid Coda directory ID')
+        const resourceId = codaIdSchema.parse(Buffer.from(id, 'hex').toString('utf8'))
+        const path = `${root}/${kind === 'group' ? 'groups' : 'workspaces'}/${encodeURIComponent(resourceId)}/${kind === 'group' ? 'members' : 'users'}`
+        for await (const page of codaPages(token, path, memberSchema, undefined, true)) {
+          for (const member of page) add(member.email)
+        }
+      } else throw new Error('Unrecognized Coda directory group')
+      return { group, memberTokens: sortAccessTokens(memberTokens), complete: true }
+    },
+  }
+}
+
+/** Setup probes endpoint access; synchronization separately drains the complete ACL. */
+export async function validateCodaDocPermissions(
+  token: string,
+  doc: CodaDoc,
+  organizationId?: string
+) {
+  const path = codaDocumentPath(doc, organizationId)
+  await codaJson(
+    token,
+    `${path}/acl/permissions`,
+    codaListSchema(permissionSchema),
+    { limit: 1 },
+    true,
+    Boolean(organizationId)
+  )
+}
diff --git a/apps/sim/connectors/coda/source.ts b/apps/sim/connectors/coda/source.ts
new file mode 100644
index 00000000000..ca1bcfaa179
--- /dev/null
+++ b/apps/sim/connectors/coda/source.ts
@@ -0,0 +1,50 @@
+import {
+  type CodaDoc,
+  codaAdminDocSchema,
+  codaDocSchema,
+  codaJson,
+  codaListSchema,
+} from '@/connectors/coda/client'
+import { codaOrganizationPath } from '@/connectors/coda/config'
+import { ConnectorSourceError } from '@/connectors/source-error'
+import { codaDocPath } from '@/tools/coda/utils'
+
+/** Uses current workspace-qualified Admin endpoints; organization-only doc endpoints are deprecated. */
+export function codaDocumentPath(doc: CodaDoc, organizationId?: string): string {
+  if (!organizationId) return codaDocPath(doc.id)
+  const { workspaceId } = codaAdminDocSchema.parse(doc)
+  return codaOrganizationPath(organizationId, 'workspaces', [workspaceId, 'workspaceId'], 'docs', [
+    doc.id,
+    'docId',
+  ])
+}
+
+/** Resolves the current workspace from the documented organization document filter. */
+export async function readCodaDoc(
+  token: string,
+  docId: string,
+  organizationId?: string,
+  validating = false
+): Promise<CodaDoc> {
+  let doc: CodaDoc
+  if (organizationId) {
+    const result = await codaJson(
+      token,
+      codaOrganizationPath(organizationId, 'docs'),
+      codaListSchema(codaAdminDocSchema),
+      { docIds: docId, limit: 1, fetchPermissionsMode: 'none' },
+      validating,
+      true
+    )
+    if (result.nextPageToken || result.items.length > 1)
+      throw new Error('Coda returned an ambiguous document lookup')
+    const found = result.items[0]
+    if (!found)
+      throw new ConnectorSourceError('Coda document was not found in the organization', 404)
+    doc = found
+  } else {
+    doc = await codaJson(token, codaDocPath(docId), codaDocSchema, undefined, validating)
+  }
+  if (doc.id !== docId) throw new Error('Coda returned a different document')
+  return doc
+}
diff --git a/apps/sim/connectors/confluence/permissions.test.ts b/apps/sim/connectors/confluence/permissions.test.ts
index 1234a6cd4e6..925230bdc21 100644
--- a/apps/sim/connectors/confluence/permissions.test.ts
+++ b/apps/sim/connectors/confluence/permissions.test.ts
@@ -2,6 +2,7 @@
  * @vitest-environment node
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_ACL_TOKENS } from '@/lib/knowledge/access/tokens'
 import {
   getReadRestriction,
   listAncestorIds,
@@ -292,20 +293,22 @@ describe('listSpaceReadPrincipals', () => {
     'rejects a repeated or missing cursor without publishing partial permissions: %s',
     async (next) => {
       mockFetch
-        .mockResolvedValueOnce(jsonResponse({ results: [], _links: { next: '?cursor=next' } }))
-        .mockResolvedValueOnce(jsonResponse({ results: [], _links: { next } }))
+        .mockResolvedValueOnce(
+          jsonResponse({ results: [{ id: 'first' }], _links: { next: '?cursor=next' } })
+        )
+        .mockResolvedValueOnce(jsonResponse({ results: [{ id: 'second' }], _links: { next } }))
 
       await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow(
-        'invalid or repeated space permissions continuation'
+        'invalid or repeated permission continuation'
       )
       expect(mockFetch).toHaveBeenCalledTimes(2)
     }
   )
 
   it('rejects a cursor cycle rather than making a hundred repeated requests', async () => {
-    for (const cursor of ['first', 'second', 'first']) {
+    for (const [page, cursor] of ['first', 'second', 'first'].entries()) {
       mockFetch.mockResolvedValueOnce(
-        jsonResponse({ results: [], _links: { next: `?cursor=${cursor}` } })
+        jsonResponse({ results: [{ id: String(page) }], _links: { next: `?cursor=${cursor}` } })
       )
     }
     await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow('repeated')
@@ -315,7 +318,7 @@ describe('listSpaceReadPrincipals', () => {
   it('rejects a malformed collection instead of treating it as a verified empty grant', async () => {
     mockFetch.mockResolvedValueOnce(jsonResponse({}))
     await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow(
-      'invalid space permissions'
+      'invalid permission page'
     )
   })
 
@@ -325,6 +328,7 @@ describe('listSpaceReadPrincipals', () => {
       jsonResponse({
         results: [
           {
+            id: String(page),
             principal: { type: 'user', id: 'reader' },
             operation: { key: 'read', targetType: 'space' },
           },
@@ -333,9 +337,129 @@ describe('listSpaceReadPrincipals', () => {
       })
     )
     await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow(
-      'exceeded 100 pages (100 entries)'
+      'exceeded 1000 pages (1000 entries)'
     )
-    expect(mockFetch).toHaveBeenCalledTimes(100)
+    expect(mockFetch).toHaveBeenCalledTimes(1000)
+  })
+
+  it('reads past 25,000 assignments and only publishes readers after the final page', async () => {
+    let page = 0
+    mockFetch.mockImplementation(async () => {
+      const current = page++
+      return jsonResponse({
+        results:
+          current < 100
+            ? Array.from({ length: 250 }, (_, index) => ({
+                id: `${current}-${index}`,
+                principal: { type: 'user', id: 'editor' },
+                operation: { key: 'create', targetType: 'page' },
+              }))
+            : [
+                {
+                  id: 'last',
+                  principal: { type: 'group', id: 'readers' },
+                  operation: { key: 'read', targetType: 'space' },
+                },
+              ],
+        _links: current < 100 ? { next: `?cursor=${page}` } : {},
+      })
+    })
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'large-space')).resolves.toEqual([
+      { kind: 'group', id: 'readers' },
+    ])
+    expect(mockFetch).toHaveBeenCalledTimes(101)
+  })
+
+  it('rejects repeated assignments even when cursors and record order change', async () => {
+    const reader = {
+      id: 'one',
+      principal: { type: 'user', id: 'reader' },
+      operation: { key: 'read', targetType: 'space' },
+    }
+    mockFetch
+      .mockResolvedValueOnce(
+        jsonResponse({ results: [reader, { id: 'two' }], _links: { next: '?cursor=one' } })
+      )
+      .mockResolvedValueOnce(
+        jsonResponse({ results: [{ id: 'two' }, reader], _links: { next: '?cursor=two' } })
+      )
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space')).rejects.toThrow(
+      'repeated a permission page'
+    )
+    expect(mockFetch).toHaveBeenCalledTimes(2)
+  })
+
+  it('follows an empty permission page that has a continuation', async () => {
+    mockFetch.mockResolvedValueOnce(jsonResponse({ results: [], _links: { next: '?cursor=next' } }))
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({
+        results: [
+          {
+            principal: { type: 'group', id: 'readers' },
+            operation: { key: 'read', targetType: 'space' },
+          },
+        ],
+      })
+    )
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space')).resolves.toEqual([
+      { kind: 'group', id: 'readers' },
+    ])
+    expect(mockFetch).toHaveBeenCalledTimes(2)
+  })
+
+  it('bounds retained readers without truncating a large grant', async () => {
+    let page = 0
+    mockFetch.mockImplementation(async () =>
+      jsonResponse({
+        results: Array.from({ length: 250 }, (_, index) => ({
+          principal: { type: 'user', id: `reader-${page}-${index}` },
+          operation: { key: 'read', targetType: 'space' },
+        })),
+        _links: { next: `?cursor=${++page}` },
+      })
+    )
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space')).rejects.toThrow(
+      'document permission limit'
+    )
+    expect(mockFetch).toHaveBeenCalledTimes(Math.floor(MAX_ACL_TOKENS / 250) + 1)
+  })
+
+  it('rejects an oversized permission response before accepting its readers', async () => {
+    mockFetch.mockResolvedValueOnce(jsonResponse({ results: [{ id: 'x'.repeat(1024 * 1024) }] }))
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space')).rejects.toThrow(
+      'exceeds maximum size'
+    )
+  })
+
+  it('does not return a partial reader list when a later permission page fails', async () => {
+    mockFetch
+      .mockResolvedValueOnce(
+        jsonResponse({
+          results: [
+            {
+              principal: { type: 'user', id: 'reader' },
+              operation: { key: 'read', targetType: 'space' },
+            },
+          ],
+          _links: { next: '?cursor=next' },
+        })
+      )
+      .mockResolvedValueOnce(jsonResponse({}, 403))
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space')).rejects.toThrow('403')
+    expect(mockFetch).toHaveBeenCalledTimes(2)
+  })
+
+  it('refuses an oversized continuation before issuing another request', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({
+        results: [],
+        _links: { next: `?cursor=${'x'.repeat(8193)}` },
+      })
+    )
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space')).rejects.toThrow(
+      'invalid or repeated permission continuation'
+    )
+    expect(mockFetch).toHaveBeenCalledTimes(1)
   })
 })
 
diff --git a/apps/sim/connectors/confluence/permissions.ts b/apps/sim/connectors/confluence/permissions.ts
index 89f98371684..5e8e8f1470e 100644
--- a/apps/sim/connectors/confluence/permissions.ts
+++ b/apps/sim/connectors/confluence/permissions.ts
@@ -1,10 +1,13 @@
+import { createHash } from 'node:crypto'
 import { createLogger } from '@sim/logger'
+import { sortObjectKeysDeep } from '@sim/utils/object'
 import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import {
   type ConfluencePrincipal,
   type ConfluenceRestriction,
   confluenceSubjectToken,
 } from '@/lib/knowledge/access/confluence-permissions'
+import { MAX_ACL_TOKENS } from '@/lib/knowledge/access/tokens'
 import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import type { RetryOptions } from '@/lib/knowledge/documents/utils'
 import { extractCursor } from '@/connectors/confluence/cursor'
@@ -21,6 +24,10 @@ const GROUP_PAGE_SIZE = 200
 
 /** Bounds provider pagination, including malformed continuation responses. */
 const MAX_PAGES = 100
+const MAX_PERMISSION_PAGES = 1000
+const PERMISSION_RESPONSE_MAX_BYTES = 1024 * 1024
+const MAX_PERMISSION_CURSOR_LENGTH = 8192
+const PERMISSION_COLLECTION_TIMEOUT_MS = 5 * 60 * 1000
 const PREFLIGHT_RESPONSE_MAX_BYTES = 256 * 1024
 
 function apiBase(cloudId: string): string {
@@ -72,34 +79,77 @@ async function getJson<T>(
 }
 
 /**
- * Drains a v2 collection by following `_links.next`, the only termination
- * Confluence documents. The requested page size is a ceiling the server may
- * lower, so a page shorter than it proves nothing.
+ * Reduces permission pages without retaining unrelated assignments. Completion
+ * requires EOF; distinct cursors cannot conceal a repeated page of assignments.
  */
-async function drainV2<T>(url: string, accessToken: string, what: string): Promise<T[]> {
-  const items: T[] = []
+async function visitPermissionPages<T>(
+  url: string,
+  accessToken: string,
+  context: { cloudId: string; spaceId: string; collection: string },
+  visit: (entries: T[]) => void
+): Promise<void> {
   const cursors = new Set<string>()
+  const pages = new Set<string>()
+  const signal = AbortSignal.timeout(PERMISSION_COLLECTION_TIMEOUT_MS)
   let cursor: string | undefined
-  for (let page = 0; page < MAX_PAGES; page += 1) {
+  let entries = 0
+  let fetchedPages = 0
+  const fail = (reason: string): never => {
+    logger.warn('Confluence permission pagination did not complete', {
+      ...context,
+      pages: fetchedPages,
+      entries,
+      reason,
+    })
+    throw new Error(`Confluence ${context.collection} ${reason}`)
+  }
+  for (let page = 0; page < MAX_PERMISSION_PAGES; page += 1) {
     const query = new URLSearchParams({ limit: String(PAGE_SIZE) })
     if (cursor) query.set('cursor', cursor)
     const body = await getJson<{ results?: T[]; _links?: { next?: string } }>(
       `${url}?${query.toString()}`,
-      accessToken
+      accessToken,
+      { maxResponseBytes: PERMISSION_RESPONSE_MAX_BYTES, retryOptions: { signal } }
     )
-    if (!Array.isArray(body.results)) {
-      throw new Error(`Confluence returned invalid ${what}`)
+    fetchedPages += 1
+    if (!Array.isArray(body.results) || body.results.length > PAGE_SIZE) {
+      return fail('returned an invalid permission page')
     }
-    items.push(...body.results)
+    const results = body.results
     const next = body._links?.next
-    if (!next) return items
+    if (results.length > 0) {
+      const fingerprint = createHash('sha256')
+        .update(
+          results
+            .map((entry) => JSON.stringify(sortObjectKeysDeep(entry)))
+            .sort()
+            .join('\n')
+        )
+        .digest('hex')
+      if (pages.has(fingerprint)) fail('repeated a permission page')
+      pages.add(fingerprint)
+    }
+    entries += results.length
+    visit(results)
+    if (!next) {
+      if (page >= MAX_PAGES) {
+        logger.info('Completed a large Confluence permission collection', {
+          ...context,
+          pages: page + 1,
+          entries,
+        })
+      }
+      return
+    }
     cursor = extractCursor(next)
-    if (!cursor || cursors.has(cursor)) {
-      throw new Error(`Confluence returned an invalid or repeated ${what} continuation`)
+    if (!cursor || cursor.length > MAX_PERMISSION_CURSOR_LENGTH) {
+      return fail('returned an invalid or repeated permission continuation')
     }
-    cursors.add(cursor)
+    const cursorHash = createHash('sha256').update(cursor).digest('hex')
+    if (cursors.has(cursorHash)) fail('returned an invalid or repeated permission continuation')
+    cursors.add(cursorHash)
   }
-  throw new Error(`Confluence ${what} exceeded ${MAX_PAGES} pages (${items.length} entries)`)
+  fail(`exceeded ${MAX_PERMISSION_PAGES} pages (${entries} entries)`)
 }
 
 /**
@@ -254,13 +304,8 @@ export async function listSpaceReadPrincipals(
   accessToken: string,
   spaceId: string
 ): Promise<ConfluencePrincipal[]> {
-  const entries = await drainV2<SpacePermissionEntry>(
-    `${apiBase(cloudId)}/api/v2/spaces/${encodeURIComponent(spaceId)}/permissions`,
-    accessToken,
-    'space permissions'
-  )
-
-  const principals: ConfluencePrincipal[] = []
+  const principals = new Map<string, ConfluencePrincipal>()
+  let principalBytes = 0
   const accessTypes = new Set<'user' | 'admin'>()
   let grantedToRole = false
   let unmapped = 0
@@ -268,7 +313,14 @@ export async function listSpaceReadPrincipals(
     if (!id) {
       unmapped += 1
     } else if (type === 'user' || type === 'group') {
-      principals.push({ kind: type, id })
+      const key = `${type}:${id}`
+      if (!principals.has(key)) {
+        principalBytes += Buffer.byteLength(key, 'utf8')
+        if (principals.size >= MAX_ACL_TOKENS || principalBytes > PERMISSION_RESPONSE_MAX_BYTES) {
+          throw new Error('Confluence space readers exceeded the document permission limit')
+        }
+        principals.set(key, { kind: type, id })
+      }
     } else if (type === 'access-class') {
       const accessClass = id.toLowerCase().replaceAll('_', '-')
       if (accessClass === 'all-licensed-users') {
@@ -281,28 +333,37 @@ export async function listSpaceReadPrincipals(
       unmapped += 1
     }
   }
-  for (const entry of entries) {
-    if (entry.operation?.key !== 'read' || entry.operation.targetType !== 'space') continue
-    const id = entry.principal?.id
-    const type = entry.principal?.type?.toLowerCase().replaceAll('_', '-')
-    if (type === 'role') {
-      grantedToRole = true
-      continue
+  await visitPermissionPages<SpacePermissionEntry>(
+    `${apiBase(cloudId)}/api/v2/spaces/${encodeURIComponent(spaceId)}/permissions`,
+    accessToken,
+    { cloudId, spaceId, collection: 'space permissions' },
+    (entries) => {
+      for (const entry of entries) {
+        if (entry.operation?.key !== 'read' || entry.operation.targetType !== 'space') continue
+        const id = entry.principal?.id
+        const type = entry.principal?.type?.toLowerCase().replaceAll('_', '-')
+        if (type === 'role') {
+          grantedToRole = true
+          continue
+        }
+        addPrincipal(type, id)
+      }
     }
-    addPrincipal(type, id)
-  }
+  )
 
   if (grantedToRole) {
-    const assignments = await drainV2<SpaceRoleAssignment>(
+    await visitPermissionPages<SpaceRoleAssignment>(
       `${apiBase(cloudId)}/api/v2/spaces/${encodeURIComponent(spaceId)}/role-assignments`,
       accessToken,
-      'space role assignments'
+      { cloudId, spaceId, collection: 'space role assignments' },
+      (assignments) => {
+        for (const assignment of assignments) {
+          const id = assignment.principal?.principalId
+          const type = assignment.principal?.principalType?.toLowerCase().replaceAll('_', '-')
+          addPrincipal(type, id)
+        }
+      }
     )
-    for (const assignment of assignments) {
-      const id = assignment.principal?.principalId
-      const type = assignment.principal?.principalType?.toLowerCase().replaceAll('_', '-')
-      addPrincipal(type, id)
-    }
   }
 
   for (const accessType of accessTypes) {
@@ -313,7 +374,7 @@ export async function listSpaceReadPrincipals(
     )
     for (const group of groups) {
       if (!group.id) throw new Error('Confluence access group is missing its id')
-      principals.push({ kind: 'group', id: group.id })
+      addPrincipal('group', group.id)
     }
   }
 
@@ -327,11 +388,7 @@ export async function listSpaceReadPrincipals(
       }
     )
   }
-  return [
-    ...new Map(
-      principals.map((principal) => [`${principal.kind}:${principal.id}`, principal])
-    ).values(),
-  ]
+  return [...principals.values()]
 }
 
 interface RestrictionPage<T> {
diff --git a/apps/sim/connectors/gmail/company-crawl.test.ts b/apps/sim/connectors/gmail/company-crawl.test.ts
index 4e73f8ef405..f0e180637a2 100644
--- a/apps/sim/connectors/gmail/company-crawl.test.ts
+++ b/apps/sim/connectors/gmail/company-crawl.test.ts
@@ -409,6 +409,69 @@ describe('company-wide Gmail indexing', () => {
     ).rejects.toThrow('403')
   })
 
+  it('continues after Gmail failedPrecondition with the later mailbox owner ACL intact', async () => {
+    fetchProvider.mockImplementation(async (url: string, init?: RequestInit) => {
+      if (
+        new URL(url).pathname.endsWith('/threads') &&
+        new Headers(init?.headers).get('Authorization')?.includes(ALICE.email)
+      ) {
+        return Response.json(
+          {
+            error: {
+              message: 'private provider response',
+              errors: [{ reason: 'failedPrecondition' }],
+            },
+          },
+          { status: 400 }
+        )
+      }
+      return providerResponse(url, init)
+    })
+    const first = await gmailConnector.listDocuments(
+      'directory-token',
+      CONFIG,
+      undefined,
+      centralContext()
+    )
+    expect(first).toMatchObject({
+      documents: [],
+      reconciliationSafe: false,
+      listingFailures: {
+        count: 1,
+        samples: [
+          {
+            scope: ALICE.email,
+            operation: 'gmail.threads.list',
+            status: 400,
+            reasons: ['failedPrecondition'],
+          },
+        ],
+      },
+    })
+    expect(JSON.stringify(first)).not.toContain('private provider response')
+    const ctx = centralContext()
+    const second = await gmailConnector.listDocuments(
+      'directory-token',
+      CONFIG,
+      first.nextCursor,
+      ctx
+    )
+    expect(second).toMatchObject({
+      hasMore: false,
+      reconciliationSafe: false,
+      listingFailures: first.listingFailures,
+    })
+    expect(second.documents[0].acl).toEqual([`u:${BOB.email}`])
+    const hydrated = await gmailConnector.getDocument(
+      'directory-token',
+      CONFIG,
+      second.documents[0].externalId,
+      ctx
+    )
+    expect(hydrated?.acl).toEqual([`u:${BOB.email}`])
+    expect(hydrated?.content).toContain('Bob private body')
+  })
+
   it('invalidates previous hydration authority when the next mailbox fails', async () => {
     const context = centralContext()
     const first = await gmailConnector.listDocuments('directory-token', CONFIG, undefined, context)
diff --git a/apps/sim/connectors/google-calendar/company-crawl.test.ts b/apps/sim/connectors/google-calendar/company-crawl.test.ts
index d1e49c9d82c..be9ecda4dea 100644
--- a/apps/sim/connectors/google-calendar/company-crawl.test.ts
+++ b/apps/sim/connectors/google-calendar/company-crawl.test.ts
@@ -340,16 +340,76 @@ describe('Google Calendar company crawl', () => {
     expect(next.documents[0].acl).toEqual([`u:${BOB.email}`])
   })
 
-  it.each([401, 403])(
-    'propagates provider HTTP %s without completing a user’s listing',
-    async (status) => {
-      fetchMock.mockResolvedValue(response({ error: { code: status } }, status))
+  it.each([
+    { status: 401, reason: 'authError' },
+    { status: 403, reason: 'insufficientPermissions' },
+    { status: 403, reason: 'SERVICE_DISABLED' },
+  ])(
+    'propagates provider authorization failures without completing a listing: $reason',
+    async ({ status, reason }) => {
+      fetchMock.mockResolvedValue(response({ error: { errors: [{ reason }] } }, status))
       await expect(
         googleCalendarConnector.listDocuments('directory-token', {}, undefined, context())
       ).rejects.toThrow()
     }
   )
 
+  it.each([{ error: { code: 403 } }, { error: { code: 403, errors: [], details: [] } }])(
+    'propagates an unclassified list access denial and retains its diagnostic: %j',
+    async (body) => {
+      fetchMock.mockResolvedValueOnce(response(body, 403))
+      const syncContext = context()
+      await expect(
+        googleCalendarConnector.listDocuments('directory-token', {}, undefined, syncContext)
+      ).rejects.toMatchObject({
+        status: 403,
+        diagnostic: { operation: 'calendar.events.list', reasons: [] },
+      })
+      expect(fetchMock).toHaveBeenCalledOnce()
+      expect(syncContext.getDelegatedAccessToken.mock.calls).toEqual([[ALICE.email]])
+    }
+  )
+
+  it('continues another user after an explicit forbidden denial and retains its diagnostic', async () => {
+    fetchMock.mockResolvedValueOnce(
+      response({ error: { code: 403, errors: [{ reason: 'forbidden' }] } }, 403)
+    )
+    const first = await googleCalendarConnector.listDocuments(
+      'directory-token',
+      {},
+      undefined,
+      context()
+    )
+    expect(first).toMatchObject({
+      documents: [],
+      hasMore: true,
+      reconciliationSafe: false,
+      listingFailures: {
+        count: 1,
+        samples: [
+          {
+            scope: ALICE.email,
+            operation: 'calendar.events.list',
+            status: 403,
+            reasons: ['forbidden'],
+          },
+        ],
+      },
+    })
+    const second = await googleCalendarConnector.listDocuments(
+      'directory-token',
+      {},
+      first.nextCursor,
+      context()
+    )
+    expect(second.documents[0].acl).toEqual([`u:${BOB.email}`])
+    expect(second).toMatchObject({
+      hasMore: false,
+      reconciliationSafe: false,
+      listingFailures: first.listingFailures,
+    })
+  })
+
   it('skips a user who became inactive before their page and never delegates to them', async () => {
     mockGetUser.mockResolvedValueOnce({ ...ALICE, active: false })
     const syncContext = context()
diff --git a/apps/sim/connectors/google-drive/directory.test.ts b/apps/sim/connectors/google-drive/directory.test.ts
index 660cd191bf3..0e630e68e11 100644
--- a/apps/sim/connectors/google-drive/directory.test.ts
+++ b/apps/sim/connectors/google-drive/directory.test.ts
@@ -3,6 +3,7 @@
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { listDomainGroups, openGoogleDirectory } from '@/connectors/google-drive/directory'
+import { ConnectorDirectoryGroupAccessError } from '@/connectors/source-error'
 
 const mockFetch = vi.fn()
 
@@ -234,6 +235,61 @@ describe('the membership a directory reports', () => {
     })
   })
 
+  it.each([
+    { status: 403, reason: 'forbidden' },
+    { status: 404, reason: 'notFound' },
+  ])(
+    'classifies inaccessible external nested groups explicitly: $status $reason',
+    async ({ status, reason }) => {
+      directory({ 'eng@corp.com': [USER('alice@corp.com'), NESTED('restricted@external.com')] })
+      const healthy = mockFetch.getMockImplementation()!
+      mockFetch.mockImplementation(async (url: string) => {
+        if (
+          decodeURIComponent(new URL(url).pathname).includes('/restricted@external.com/members')
+        ) {
+          return jsonResponse(
+            { error: { errors: [{ reason }], message: 'private detail' } },
+            status
+          )
+        }
+        return healthy(url)
+      })
+      const failure = await membersOf(GROUP).catch((error: unknown) => error)
+      expect(failure).toBeInstanceOf(ConnectorDirectoryGroupAccessError)
+      expect(failure).toMatchObject({
+        cause: { status, diagnostic: { operation: 'directory.members.list', reasons: [reason] } },
+      })
+      expect(String(failure)).not.toContain('private detail')
+    }
+  )
+
+  it.each([
+    { email: 'restricted@corp.io', status: 403, reasons: ['forbidden'] },
+    { email: 'restricted@external.com', status: 403, reasons: [] },
+    { email: 'restricted@external.com', status: 403, reasons: ['forbidden', 'unknownReason'] },
+    {
+      email: 'restricted@external.com',
+      status: 403,
+      reasons: ['forbidden', 'insufficientPermissions'],
+    },
+    { email: 'restricted@external.com', status: 401, reasons: ['authError'] },
+  ])(
+    'does not classify uncertain or customer-owned failures as external access failures: $email $status $reasons',
+    async ({ email, status, reasons }) => {
+      directory({ 'eng@corp.com': [NESTED(email)] })
+      const healthy = mockFetch.getMockImplementation()!
+      mockFetch.mockImplementation(async (url: string) => {
+        if (decodeURIComponent(new URL(url).pathname).includes(`/${email}/members`)) {
+          return jsonResponse({ error: { errors: reasons.map((reason) => ({ reason })) } }, status)
+        }
+        return healthy(url)
+      })
+      const failure = await membersOf(GROUP).catch((error: unknown) => error)
+      expect(failure).not.toBeInstanceOf(ConnectorDirectoryGroupAccessError)
+      expect(failure).toMatchObject({ status })
+    }
+  )
+
   /** A directory that hiccups must not cost a group its membership; transient errors are retried. */
   it('retries a transient directory error before giving up', async () => {
     directory({ 'eng@corp.com': [USER('alice@corp.com')] })
diff --git a/apps/sim/connectors/google-drive/directory.ts b/apps/sim/connectors/google-drive/directory.ts
index dd2b9ec1eda..78bb57e75ef 100644
--- a/apps/sim/connectors/google-drive/directory.ts
+++ b/apps/sim/connectors/google-drive/directory.ts
@@ -16,6 +16,7 @@ import {
   fetchGoogleDriveWithRetry,
   GoogleDriveApiError,
 } from '@/connectors/google-drive/google-drive-errors'
+import { ConnectorDirectoryGroupAccessError } from '@/connectors/source-error'
 import type {
   ConnectorDirectory,
   ConnectorDirectoryGroup,
@@ -249,7 +250,28 @@ async function listGroupMembers(
       return
     }
 
-    for (const member of await membersOf(groupId)) {
+    let members: RawMember[]
+    try {
+      members = await membersOf(groupId)
+    } catch (error) {
+      const groupDomain = emailDomain(groupId)
+      if (
+        depth > 0 &&
+        groupDomain &&
+        !customerDomains.includes(groupDomain) &&
+        error instanceof GoogleDriveApiError &&
+        error.reasonsComplete &&
+        ((error.status === 403 && error.reasons.length === 1 && error.reasons[0] === 'forbidden') ||
+          (error.status === 404 && error.reasons.length === 1 && error.reasons[0] === 'notFound'))
+      ) {
+        throw new ConnectorDirectoryGroupAccessError('An external nested group cannot be read', {
+          cause: error,
+        })
+      }
+      throw error
+    }
+
+    for (const member of members) {
       if (member.status && member.status.toUpperCase() !== 'ACTIVE') continue
       const type = member.type?.toUpperCase()
 
diff --git a/apps/sim/connectors/google-drive/google-drive-errors.ts b/apps/sim/connectors/google-drive/google-drive-errors.ts
index 86a582a68b2..141a0195906 100644
--- a/apps/sim/connectors/google-drive/google-drive-errors.ts
+++ b/apps/sim/connectors/google-drive/google-drive-errors.ts
@@ -6,7 +6,7 @@ import {
   retryWithExponentialBackoff,
 } from '@/lib/knowledge/documents/utils'
 import {
-  readGoogleErrorReasons,
+  readGoogleErrorDetails,
   safeGoogleErrorReasons,
 } from '@/connectors/google-workspace/api-errors'
 import {
@@ -104,8 +104,14 @@ export class GoogleDriveApiError extends ConnectorSourceError {
   readonly reasons: readonly string[]
   readonly kind: GoogleDriveErrorKind
   readonly rateLimited: boolean
+  readonly reasonsComplete: boolean
 
-  constructor(status: number, normalizedReasons: readonly string[], operation = 'drive.request') {
+  constructor(
+    status: number,
+    normalizedReasons: readonly string[],
+    operation = 'drive.request',
+    reasonsComplete = true
+  ) {
     const diagnosticReasons = safeGoogleErrorReasons(normalizedReasons).slice(
       0,
       GOOGLE_ERROR_REASON_MAX_COUNT
@@ -123,6 +129,8 @@ export class GoogleDriveApiError extends ConnectorSourceError {
     this.kind = kind
     this.rateLimited =
       status === 429 || normalizedReasons.some((reason) => RATE_LIMIT_REASONS.has(reason))
+    this.reasonsComplete =
+      reasonsComplete && normalizedReasons.every((reason) => diagnosticReasons.includes(reason))
   }
 }
 
@@ -135,7 +143,8 @@ export async function readGoogleDriveApiError(
   response: Response,
   operation = 'drive.request'
 ): Promise<GoogleDriveApiError> {
-  return new GoogleDriveApiError(response.status, await readGoogleErrorReasons(response), operation)
+  const details = await readGoogleErrorDetails(response)
+  return new GoogleDriveApiError(response.status, details.reasons, operation, details.complete)
 }
 
 /**
diff --git a/apps/sim/connectors/google-workspace/api-errors.test.ts b/apps/sim/connectors/google-workspace/api-errors.test.ts
index f6e4ace1b8f..04ca5ec08ce 100644
--- a/apps/sim/connectors/google-workspace/api-errors.test.ts
+++ b/apps/sim/connectors/google-workspace/api-errors.test.ts
@@ -39,6 +39,7 @@ describe('Google API diagnostics', () => {
   it('omits unknown reason tokens even when they look like machine codes', async () => {
     const error = await readGoogleApiError(failure(403, RESPONSE_SECRET), OPERATION)
     expect(error.diagnostic?.reasons).toEqual([])
+    expect(error.reasonsComplete).toBe(false)
     expect(JSON.stringify(error)).not.toContain(RESPONSE_SECRET)
   })
 
@@ -70,8 +71,57 @@ describe('Google API diagnostics', () => {
       const error = await readGoogleApiError(new Response(body, { status: 400 }), OPERATION)
       expect(error.status).toBe(400)
       expect(error.diagnostic?.reasons).toEqual([])
+      expect(error.reasonsComplete).toBe(false)
     }
   )
+
+  it('distinguishes a valid reasonless envelope from stripped or malformed reasons', async () => {
+    const absent = await readGoogleApiError(
+      Response.json({ error: { code: 403, message: RESPONSE_SECRET } }, { status: 403 }),
+      'calendar.events.list'
+    )
+    expect(absent.reasonsComplete).toBe(true)
+    expect(absent.diagnostic?.reasons).toEqual([])
+    const malformed = await readGoogleApiError(
+      Response.json({ error: { errors: [{ reason: 123 }] } }, { status: 403 }),
+      'calendar.events.list'
+    )
+    expect(malformed.reasonsComplete).toBe(false)
+    const mixed = await readGoogleApiError(
+      Response.json(
+        { error: { errors: [{ reason: 'forbidden' }, { reason: RESPONSE_SECRET }] } },
+        { status: 403 }
+      ),
+      'calendar.events.list'
+    )
+    expect(mixed.diagnostic?.reasons).toEqual(['forbidden'])
+    expect(mixed.reasonsComplete).toBe(false)
+    expect(JSON.stringify([absent, malformed, mixed])).not.toContain(RESPONSE_SECRET)
+  })
+
+  it.each([{ error: [] }, { error: {} }, { error: { code: 401 } }])(
+    'does not classify a malformed or inconsistent reasonless envelope as complete: %j',
+    async (payload) => {
+      const error = await readGoogleApiError(
+        Response.json(payload, { status: 403 }),
+        'calendar.events.list'
+      )
+      expect(error.reasonsComplete).toBe(false)
+    }
+  )
+
+  it('retains recognized diagnostics when another part of the envelope is malformed', async () => {
+    const error = await readGoogleApiError(
+      Response.json(
+        { error: { errors: [{ reason: 'forbidden' }], details: RESPONSE_SECRET } },
+        { status: 403 }
+      ),
+      'calendar.events.list'
+    )
+    expect(error.diagnostic?.reasons).toEqual(['forbidden'])
+    expect(error.reasonsComplete).toBe(false)
+    expect(JSON.stringify(error)).not.toContain(RESPONSE_SECRET)
+  })
 })
 
 describe('Google API retries', () => {
diff --git a/apps/sim/connectors/google-workspace/api-errors.ts b/apps/sim/connectors/google-workspace/api-errors.ts
index 12653fd37c8..e5c16f75b02 100644
--- a/apps/sim/connectors/google-workspace/api-errors.ts
+++ b/apps/sim/connectors/google-workspace/api-errors.ts
@@ -57,35 +57,55 @@ export function safeGoogleErrorReasons(reasons: readonly string[]): string[] {
   return [...new Set(reasons.filter((reason) => SAFE_REASONS.has(reason)))]
 }
 
-/** Reads the bounded Google envelope without retaining provider messages or request data. */
-export async function readGoogleErrorReasons(response: Response): Promise<string[]> {
+/** Distinguishes a reasonless envelope from one whose reason codes cannot safely be interpreted. */
+export async function readGoogleErrorDetails(
+  response: Response
+): Promise<{ reasons: string[]; complete: boolean }> {
+  const unreadable = { reasons: [], complete: false }
   const body = await readBodyWithLimit(response, ERROR_BODY_MAX_BYTES).catch(() => null)
-  if (!body) return []
+  if (!body) return unreadable
   try {
     const payload: unknown = JSON.parse(body.toString('utf8'))
-    if (!payload || typeof payload !== 'object' || !('error' in payload)) return []
+    if (!payload || typeof payload !== 'object' || !('error' in payload)) return unreadable
     const error = payload.error
-    if (!error || typeof error !== 'object') return []
+    if (!error || typeof error !== 'object' || Array.isArray(error)) return unreadable
+    const envelopeValid =
+      (!('errors' in error) || Array.isArray(error.errors)) &&
+      (!('details' in error) || Array.isArray(error.details))
     const entries = [
       ...('errors' in error && Array.isArray(error.errors) ? error.errors : []),
       ...('details' in error && Array.isArray(error.details) ? error.details : []),
     ]
-    return safeGoogleErrorReasons(
-      entries.flatMap((entry: unknown) =>
-        entry && typeof entry === 'object' && 'reason' in entry && typeof entry.reason === 'string'
-          ? [entry.reason]
-          : []
-      )
+    const reasons = entries.flatMap((entry: unknown) =>
+      entry && typeof entry === 'object' && 'reason' in entry && typeof entry.reason === 'string'
+        ? [entry.reason]
+        : []
     )
+    const safeReasons = safeGoogleErrorReasons(reasons)
+    return {
+      reasons: safeReasons,
+      complete:
+        envelopeValid &&
+        (entries.length > 0 || ('code' in error && error.code === response.status)) &&
+        reasons.length === entries.length &&
+        reasons.every((reason) => SAFE_REASONS.has(reason)) &&
+        safeReasons.length <= MAX_REASONS,
+    }
   } catch {
-    return []
+    return unreadable
   }
 }
 
 export class GoogleApiError extends ConnectorSourceError {
   readonly rateLimited: boolean
+  readonly reasonsComplete: boolean
   retryAfterMs?: number
-  constructor(operation: string, status: number, reasons: readonly string[]) {
+  constructor(
+    operation: string,
+    status: number,
+    reasons: readonly string[],
+    reasonsComplete = true
+  ) {
     const safeReasons = safeGoogleErrorReasons(reasons)
     const suffix = safeReasons.length ? ` (${safeReasons.join(', ')})` : ''
     const category =
@@ -105,6 +125,10 @@ export class GoogleApiError extends ConnectorSourceError {
       reasons: safeReasons.slice(0, MAX_REASONS),
     })
     this.name = 'GoogleApiError'
+    this.reasonsComplete =
+      reasonsComplete &&
+      reasons.every((reason) => SAFE_REASONS.has(reason)) &&
+      safeReasons.length <= MAX_REASONS
     this.rateLimited =
       status === 429 || safeReasons.some((reason) => RATE_LIMIT_REASONS.has(reason))
   }
@@ -114,7 +138,8 @@ export async function readGoogleApiError(
   response: Response,
   operation: string
 ): Promise<GoogleApiError> {
-  return new GoogleApiError(operation, response.status, await readGoogleErrorReasons(response))
+  const details = await readGoogleErrorDetails(response)
+  return new GoogleApiError(operation, response.status, details.reasons, details.complete)
 }
 
 /** Preserves Google diagnostics when the shared transport retries a transient HTTP response. */
diff --git a/apps/sim/connectors/google-workspace/company-crawl.test.ts b/apps/sim/connectors/google-workspace/company-crawl.test.ts
index 1e34062abfc..0c8c5c16041 100644
--- a/apps/sim/connectors/google-workspace/company-crawl.test.ts
+++ b/apps/sim/connectors/google-workspace/company-crawl.test.ts
@@ -1,5 +1,6 @@
 /** @vitest-environment node */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { GoogleApiError, readGoogleApiError } from '@/connectors/google-workspace/api-errors'
 import {
   getGoogleWorkspaceDocument,
   InvalidGoogleWorkspaceCursor,
@@ -54,9 +55,14 @@ function document(ctx?: Record<string, unknown>, id = 'shared-provider-id'): Ext
   }
 }
 const listUserDocuments = vi.fn<ConnectorConfig['listDocuments']>()
-function list(syncContext: Record<string, unknown>, cursor?: string, sourceConfig = CONFIG) {
+function list(
+  syncContext: Record<string, unknown>,
+  cursor?: string,
+  sourceConfig = CONFIG,
+  provider: 'gmail' | 'google_calendar' = 'gmail'
+) {
   return listGoogleWorkspaceDocuments({
-    provider: 'gmail',
+    provider,
     accessToken: 'directory-token',
     sourceConfig,
     syncContext,
@@ -373,7 +379,7 @@ describe('Google Workspace per-user central crawl', () => {
     const url = new URL(mockFetch.mock.calls[0][0])
     expect(url.searchParams.get('maxResults')).toBe('100')
     expect(url.searchParams.get('fields')).toBe(
-      'kind,nextPageToken,users(id,primaryEmail,customerId,suspended,archived,isGuestUser)'
+      'kind,nextPageToken,users(id,primaryEmail,customerId,suspended,archived,isGuestUser,isMailboxSetup)'
     )
   })
 
@@ -410,6 +416,219 @@ describe('Google Workspace per-user central crawl', () => {
     await list(ctx)
     expect(ctx.listingCapped).toBe(true)
   })
+
+  it('continues after an unavailable Gmail mailbox and persists the failure across fresh workers', async () => {
+    listUserDocuments.mockRejectedValueOnce(
+      new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
+    )
+    const first = await list(context())
+    expect(first).toMatchObject({
+      documents: [],
+      hasMore: true,
+      reconciliationSafe: false,
+      listingFailures: {
+        count: 1,
+        samples: [
+          {
+            scope: 'alice@corp.com',
+            operation: 'gmail.threads.list',
+            status: 400,
+            reasons: ['failedPrecondition'],
+          },
+        ],
+      },
+    })
+    const second = await list(context(), first.nextCursor)
+    expect(second.documents[0].acl).toEqual(['u:bob@corp.com'])
+    expect(second).toMatchObject({
+      hasMore: false,
+      reconciliationSafe: false,
+      listingFailures: first.listingFailures,
+    })
+    expect(listUserDocuments.mock.calls[1][0]).toBe('delegated:bob@corp.com')
+  })
+
+  it('replays a skipped user without double-counting and retries it on the next generation', async () => {
+    const unavailable = new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
+    listUserDocuments.mockRejectedValueOnce(unavailable).mockRejectedValueOnce(unavailable)
+    const first = await list(context())
+    const replay = await list(context(), first.currentCursor)
+    expect(replay.nextCursor).toBe(first.nextCursor)
+    expect(replay.listingFailures?.count).toBe(1)
+    const nextGeneration = await list(context())
+    expect(nextGeneration.documents[0].acl).toEqual(['u:alice@corp.com'])
+    expect(nextGeneration.listingFailures).toBeUndefined()
+  })
+
+  it('preserves failure evidence when advancing to another Directory page', async () => {
+    mockFetch.mockResolvedValueOnce(json({ users: [USER('alice')], nextPageToken: 'directory-2' }))
+    listUserDocuments.mockRejectedValueOnce(
+      new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
+    )
+    const first = await list(context())
+    mockFetch.mockResolvedValueOnce(json({ users: [USER('bob')] }))
+    const second = await list(context(), first.nextCursor)
+    expect(second.documents[0].acl).toEqual(['u:bob@corp.com'])
+    expect(second.listingFailures).toEqual(first.listingFailures)
+    expect(second.reconciliationSafe).toBe(false)
+  })
+
+  it.each([true, undefined])(
+    'keeps Gmail users eligible when mailbox metadata is %s',
+    async (isMailboxSetup) => {
+      directory([USER('alice', undefined, { isMailboxSetup })])
+      expect((await list(context())).documents).toHaveLength(1)
+      expect(listUserDocuments).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('skips an explicitly unprovisioned Gmail mailbox before requesting a token', async () => {
+    directory([USER('alice', undefined, { isMailboxSetup: false }), USER('bob')])
+    const ctx = context()
+    const first = await list(ctx)
+    expect(first.listingFailures?.samples[0]).toEqual({
+      scope: 'alice@corp.com',
+      operation: 'directory.users.get',
+      reasons: ['mailboxNotSetup'],
+    })
+    expect(ctx.getDelegatedAccessToken).not.toHaveBeenCalled()
+    const second = await list(context(), first.nextCursor)
+    expect(second.documents[0].acl).toEqual(['u:bob@corp.com'])
+  })
+
+  it('does not use Gmail mailbox eligibility for Calendar', async () => {
+    directory([USER('alice', undefined, { isMailboxSetup: false })])
+    expect((await list(context(), undefined, CONFIG, 'google_calendar')).documents).toHaveLength(1)
+  })
+
+  it('isolates explicit Calendar list access failures without claiming a disabled service', async () => {
+    listUserDocuments.mockRejectedValueOnce(
+      new GoogleApiError('calendar.events.list', 403, ['forbidden'])
+    )
+    const first = await list(context(), undefined, CONFIG, 'google_calendar')
+    expect(first.listingFailures?.samples[0]).toEqual({
+      scope: 'alice@corp.com',
+      operation: 'calendar.events.list',
+      status: 403,
+      reasons: ['forbidden'],
+    })
+    const second = await list(context(), first.nextCursor, CONFIG, 'google_calendar')
+    expect(second.documents[0].acl).toEqual(['u:bob@corp.com'])
+    expect(second.reconciliationSafe).toBe(false)
+  })
+
+  it.each([{ error: { code: 403 } }, { error: { code: 403, errors: [], details: [] } }])(
+    'propagates a Calendar 403 without reason codes: %j',
+    async (body) => {
+      const error = await readGoogleApiError(json(body, 403), 'calendar.events.list')
+      listUserDocuments.mockRejectedValueOnce(error)
+      const ctx: Record<string, unknown> = context()
+
+      await expect(list(ctx, undefined, CONFIG, 'google_calendar')).rejects.toBe(error)
+      expect(ctx.reconciliationUnsafe).toBeUndefined()
+      expect(listUserDocuments).toHaveBeenCalledOnce()
+    }
+  )
+
+  it.each([
+    [403, []],
+    [403, ['rateLimitExceeded']],
+    [403, ['userRateLimitExceeded']],
+    [403, ['quotaExceeded']],
+    [403, ['insufficientPermissions']],
+    [403, ['ACCESS_TOKEN_SCOPE_INSUFFICIENT']],
+    [403, ['SERVICE_DISABLED']],
+    [403, ['domainPolicy']],
+    [403, ['unrecognized-provider-code']],
+    [403, ['forbidden', 'unrecognized-provider-code']],
+    [401, ['authError']],
+    [429, []],
+    [500, ['backendError']],
+  ] as const)(
+    'does not skip global or retryable Calendar errors (%s %j)',
+    async (status, reasons) => {
+      const error = new GoogleApiError('calendar.events.list', status, reasons)
+      listUserDocuments.mockRejectedValueOnce(error)
+      await expect(list(context(), undefined, CONFIG, 'google_calendar')).rejects.toBe(error)
+    }
+  )
+
+  it.each([
+    new GoogleApiError('gmail.threads.list', 400, ['badRequest']),
+    new GoogleApiError('gmail.threads.list', 400, []),
+    new GoogleApiError('gmail.labels.list', 400, ['failedPrecondition']),
+    new GoogleApiError('calendar.calendarList.list', 403, ['forbidden']),
+    new Error('unknown provider failure'),
+  ])('does not suppress unclassified failures: %s', async (error) => {
+    listUserDocuments.mockRejectedValueOnce(error)
+    await expect(list(context())).rejects.toBe(error)
+  })
+
+  it('does not isolate an unreadable Calendar error envelope', async () => {
+    const error = new GoogleApiError('calendar.events.list', 403, [], false)
+    listUserDocuments.mockRejectedValueOnce(error)
+    await expect(list(context(), undefined, CONFIG, 'google_calendar')).rejects.toBe(error)
+  })
+
+  it('does not suppress delegation failures that resemble provider list failures', async () => {
+    const ctx = context()
+    const error = new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
+    ctx.getDelegatedAccessToken.mockRejectedValueOnce(error)
+    await expect(list(ctx)).rejects.toBe(error)
+    expect(listUserDocuments).not.toHaveBeenCalled()
+  })
+
+  it('honors cancellation before recording an otherwise isolatable error', async () => {
+    const controller = new AbortController()
+    listUserDocuments.mockImplementationOnce(async () => {
+      controller.abort()
+      throw new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
+    })
+    await expect(list({ ...context(), signal: controller.signal })).rejects.toMatchObject({
+      name: 'AbortError',
+    })
+  })
+
+  it('revokes the prior page hydration authority when the next user fails', async () => {
+    const ctx = context()
+    const first = await list(ctx)
+    listUserDocuments.mockRejectedValueOnce(
+      new GoogleApiError('gmail.threads.list', 400, ['failedPrecondition'])
+    )
+    await list(ctx, first.nextCursor)
+    const hydrate = vi.fn()
+    await expect(
+      getGoogleWorkspaceDocument({
+        provider: 'gmail',
+        sourceConfig: CONFIG,
+        externalId: first.documents[0].externalId,
+        syncContext: ctx,
+        getUserDocument: hydrate,
+      })
+    ).rejects.toThrow('verified delegated listing identity')
+    expect(hydrate).not.toHaveBeenCalled()
+  })
+
+  it('bounds retained failure samples while counting every unavailable user', async () => {
+    directory(
+      Array.from({ length: 15 }, (_, index) =>
+        USER(`user-${index}`, undefined, { isMailboxSetup: false })
+      )
+    )
+    let cursor: string | undefined
+    let final
+    for (let i = 0; i < 15; i++) {
+      final = await list(context(), cursor)
+      cursor = final.nextCursor
+    }
+    expect(final).toMatchObject({
+      hasMore: false,
+      listingFailures: { count: 15 },
+      reconciliationSafe: false,
+    })
+    expect(final?.listingFailures?.samples).toHaveLength(10)
+    expect(listUserDocuments).not.toHaveBeenCalled()
+  })
 })
 
 describe('Google Workspace central validation', () => {
diff --git a/apps/sim/connectors/google-workspace/company-crawl.ts b/apps/sim/connectors/google-workspace/company-crawl.ts
index cb7a3c7b0b1..3a354ad36f3 100644
--- a/apps/sim/connectors/google-workspace/company-crawl.ts
+++ b/apps/sim/connectors/google-workspace/company-crawl.ts
@@ -1,6 +1,8 @@
+import { createLogger } from '@sim/logger'
 import { normalizeEmail } from '@sim/utils/string'
 import { z } from 'zod'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
+import { GoogleApiError } from '@/connectors/google-workspace/api-errors'
 import {
   GOOGLE_WORKSPACE_USERS_PAGE_SIZE,
   type GoogleWorkspaceUser,
@@ -8,11 +10,18 @@ import {
   listGoogleWorkspaceUsers,
   selectedGoogleWorkspaceUsers,
 } from '@/connectors/google-workspace/users'
+import { listingFailuresSchema, MAX_LISTING_FAILURE_SAMPLES } from '@/connectors/listing-failures'
 import { ConnectorSourceError } from '@/connectors/source-error'
-import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
+import type {
+  ConnectorConfig,
+  ExternalDocument,
+  ExternalDocumentList,
+  ExternalListingFailures,
+} from '@/connectors/types'
 import { PER_MEMBER_LISTING_CONTEXT, sourceDocumentId } from '@/connectors/utils'
 
 type GoogleWorkspaceProvider = 'gmail' | 'google_calendar'
+const logger = createLogger('GoogleWorkspaceCrawl')
 const CURSOR_PREFIX = 'google-workspace:v1:'
 const MAX_CURSOR_BYTES = 384 * 1024
 const MAX_PROVIDER_CURSOR_BYTES = 256 * 1024
@@ -30,6 +39,7 @@ const cursorSchema = z.object({
     .max(GOOGLE_WORKSPACE_USERS_PAGE_SIZE),
   nextUsersPageToken: z.string().min(1).max(8192).optional(),
   providerCursor: z.string().min(1).max(MAX_PROVIDER_CURSOR_BYTES).optional(),
+  listingFailures: listingFailuresSchema.optional(),
 })
 type CompanyCursor = z.infer<typeof cursorSchema>
 
@@ -128,6 +138,28 @@ function ownerDocument(document: ExternalDocument, access: DelegatedUser): Exter
   return { ...document, acl: [`u:${access.user.email}`] }
 }
 
+/** Isolates narrow user-list failures; delegation, known scope errors and quota errors still fail. */
+function userListingFailure(
+  error: unknown,
+  provider: GoogleWorkspaceProvider
+): Omit<ExternalListingFailures['samples'][number], 'scope'> | null {
+  if (!(error instanceof GoogleApiError) || !error.diagnostic || !error.reasonsComplete) return null
+  const reasons = error.diagnostic.reasons
+  const isolated =
+    provider === 'gmail'
+      ? error.diagnostic.operation === 'gmail.threads.list' &&
+        error.status === 400 &&
+        reasons.length > 0 &&
+        reasons.every((reason) => reason === 'failedPrecondition')
+      : error.diagnostic.operation === 'calendar.events.list' &&
+        error.status === 403 &&
+        reasons.length > 0 &&
+        reasons.every((reason) => reason === 'forbidden')
+  return isolated
+    ? { operation: error.diagnostic.operation, status: error.status, reasons: [...reasons] }
+    : null
+}
+
 /** Validates directory access and returns one revalidated identity for a provider-specific probe. */
 export async function validateGoogleWorkspaceConfig(
   input: GoogleWorkspaceCrawlInput
@@ -217,6 +249,7 @@ export async function listGoogleWorkspaceDocuments(
         .filter((user) => user.active && (!selected.length || selected.includes(user.email)))
         .map(({ id, email, customerId }) => ({ id, email, customerId })),
       nextUsersPageToken: page.nextPageToken,
+      listingFailures: state.listingFailures,
     }
   }
   const currentCursor = writeCursor(state)
@@ -225,6 +258,7 @@ export async function listGoogleWorkspaceDocuments(
     provider,
     users: state.users.slice(1),
     nextUsersPageToken: state.nextUsersPageToken,
+    listingFailures: state.listingFailures,
   })
   const emptyPage = (next: CompanyCursor): ExternalDocumentList => {
     const hasMore = Boolean(next.users.length || next.nextUsersPageToken)
@@ -233,6 +267,10 @@ export async function listGoogleWorkspaceDocuments(
       currentCursor,
       hasMore,
       nextCursor: hasMore ? writeCursor(next) : undefined,
+      ...(next.listingFailures && {
+        listingFailures: next.listingFailures,
+        reconciliationSafe: false,
+      }),
     }
   }
   if (!pending) return emptyPage(state)
@@ -240,6 +278,25 @@ export async function listGoogleWorkspaceDocuments(
   if (user) assertIdentity(user, pending)
   if (!user?.active || (selected.length && !selected.includes(user.email)))
     return emptyPage(advance())
+  const failedUser = (
+    failure: Omit<ExternalListingFailures['samples'][number], 'scope'>
+  ): ExternalDocumentList => {
+    const sample = { scope: user.email, ...failure }
+    const previous = state.listingFailures
+    state.listingFailures = {
+      count: (previous?.count ?? 0) + 1,
+      samples: [...(previous?.samples ?? []), sample].slice(0, MAX_LISTING_FAILURE_SAMPLES),
+    }
+    syncContext.reconciliationUnsafe = true
+    logger.warn('Google Workspace user could not be listed; continuing other users', {
+      provider,
+      ...sample,
+    })
+    return emptyPage(advance())
+  }
+  if (provider === 'gmail' && user.isMailboxSetup === false) {
+    return failedUser({ operation: 'directory.users.get', reasons: ['mailboxNotSetup'] })
+  }
   const access: PageAccess = {
     provider,
     user,
@@ -254,12 +311,20 @@ export async function listGoogleWorkspaceDocuments(
     externalIds: new Set(),
   }
   access.syncContext.signal = signal
-  const page = await listUserDocuments(
-    access.accessToken,
-    sourceConfig,
-    state.providerCursor,
-    access.syncContext
-  )
+  let page: ExternalDocumentList
+  try {
+    page = await listUserDocuments(
+      access.accessToken,
+      sourceConfig,
+      state.providerCursor,
+      access.syncContext
+    )
+  } catch (error) {
+    signal?.throwIfAborted()
+    const failure = userListingFailure(error, provider)
+    if (!failure) throw error
+    return failedUser(failure)
+  }
   signal?.throwIfAborted()
   if (access.syncContext.listingCapped === true) syncContext.listingCapped = true
   if (page.documents.length > MAX_PAGE_DOCUMENTS)
@@ -277,6 +342,10 @@ export async function listGoogleWorkspaceDocuments(
     currentCursor: writeCursor(replay),
     hasMore,
     nextCursor: hasMore ? writeCursor(next) : undefined,
+    ...(state.listingFailures && {
+      listingFailures: state.listingFailures,
+      reconciliationSafe: false,
+    }),
   }
   access.externalIds = new Set(documents.map((document) => document.externalId))
   pageAccess.set(syncContext, access)
diff --git a/apps/sim/connectors/google-workspace/users.ts b/apps/sim/connectors/google-workspace/users.ts
index f5c2baf3204..49f67dbeca8 100644
--- a/apps/sim/connectors/google-workspace/users.ts
+++ b/apps/sim/connectors/google-workspace/users.ts
@@ -18,6 +18,7 @@ export interface GoogleWorkspaceUser {
   email: string
   customerId: string
   active: boolean
+  isMailboxSetup?: boolean
 }
 
 export interface GoogleWorkspaceUserPage {
@@ -58,7 +59,8 @@ function parseUser(value: unknown): GoogleWorkspaceUser {
     !emailSchema.safeParse(value.primaryEmail).success ||
     typeof value.suspended !== 'boolean' ||
     (value.archived !== undefined && typeof value.archived !== 'boolean') ||
-    (value.isGuestUser !== undefined && typeof value.isGuestUser !== 'boolean')
+    (value.isGuestUser !== undefined && typeof value.isGuestUser !== 'boolean') ||
+    (value.isMailboxSetup !== undefined && typeof value.isMailboxSetup !== 'boolean')
   ) {
     throw new Error('Google Workspace returned malformed user metadata')
   }
@@ -67,6 +69,7 @@ function parseUser(value: unknown): GoogleWorkspaceUser {
     email: normalizeEmail(value.primaryEmail),
     customerId: value.customerId,
     active: !value.suspended && value.archived !== true && value.isGuestUser !== true,
+    ...(typeof value.isMailboxSetup === 'boolean' && { isMailboxSetup: value.isMailboxSetup }),
   }
 }
 
@@ -80,7 +83,7 @@ async function readDirectoryJson(response: Response): Promise<unknown> {
   }
 }
 
-const USER_FIELDS = 'id,primaryEmail,customerId,suspended,archived,isGuestUser'
+const USER_FIELDS = 'id,primaryEmail,customerId,suspended,archived,isGuestUser,isMailboxSetup'
 
 /** One provider page only; the connector checkpoint advances through the directory. */
 export async function listGoogleWorkspaceUsers(
diff --git a/apps/sim/connectors/listing-failures.ts b/apps/sim/connectors/listing-failures.ts
new file mode 100644
index 00000000000..d64e85bfd82
--- /dev/null
+++ b/apps/sim/connectors/listing-failures.ts
@@ -0,0 +1,18 @@
+import { z } from 'zod'
+
+export const MAX_LISTING_FAILURE_SAMPLES = 10
+
+/** Persist only bounded scope identifiers and provider-owned codes, never raw errors or content. */
+export const listingFailuresSchema = z.object({
+  count: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  samples: z
+    .array(
+      z.object({
+        scope: z.string().min(1).max(254),
+        operation: z.string().min(1).max(96),
+        status: z.number().int().min(100).max(599).optional(),
+        reasons: z.array(z.string().min(1).max(64)).max(16),
+      })
+    )
+    .max(MAX_LISTING_FAILURE_SAMPLES),
+})
diff --git a/apps/sim/connectors/permission-scoped-listing.test.ts b/apps/sim/connectors/permission-scoped-listing.test.ts
index 5d1b5764f66..32dbbc4d62e 100644
--- a/apps/sim/connectors/permission-scoped-listing.test.ts
+++ b/apps/sim/connectors/permission-scoped-listing.test.ts
@@ -41,6 +41,7 @@ describe('permission-scoped connector listings', () => {
   it('offers Search only for reviewed source and permission capabilities', () => {
     const search = Object.values(CONNECTOR_META_REGISTRY).filter((meta) => meta.search)
     expect(search.map((meta) => meta.id).sort()).toEqual([
+      'coda',
       'confluence',
       'github',
       'gitlab',
diff --git a/apps/sim/connectors/registry.server.ts b/apps/sim/connectors/registry.server.ts
index c351ad50d5d..a07a0ffef53 100644
--- a/apps/sim/connectors/registry.server.ts
+++ b/apps/sim/connectors/registry.server.ts
@@ -6,6 +6,7 @@ import { bitbucketConnector } from '@/connectors/bitbucket'
 import { boxConnector } from '@/connectors/box'
 import { circlebackConnector } from '@/connectors/circleback'
 import { clickupConnector } from '@/connectors/clickup'
+import { codaConnector } from '@/connectors/coda'
 import { confluenceConnector } from '@/connectors/confluence'
 import { databricksConnector } from '@/connectors/databricks'
 import { discordConnector } from '@/connectors/discord'
@@ -81,6 +82,7 @@ export const CONNECTOR_REGISTRY: ConnectorRegistry = {
   box: boxConnector,
   circleback: circlebackConnector,
   clickup: clickupConnector,
+  coda: codaConnector,
   confluence: confluenceConnector,
   databricks: databricksConnector,
   discord: discordConnector,
diff --git a/apps/sim/connectors/registry.ts b/apps/sim/connectors/registry.ts
index 705995174e3..8e5a5d452f3 100644
--- a/apps/sim/connectors/registry.ts
+++ b/apps/sim/connectors/registry.ts
@@ -6,6 +6,7 @@ import { bitbucketConnectorMeta } from '@/connectors/bitbucket/meta'
 import { boxConnectorMeta } from '@/connectors/box/meta'
 import { circlebackConnectorMeta } from '@/connectors/circleback/meta'
 import { clickupConnectorMeta } from '@/connectors/clickup/meta'
+import { codaConnectorMeta } from '@/connectors/coda/meta'
 import { confluenceConnectorMeta } from '@/connectors/confluence/meta'
 import { databricksConnectorMeta } from '@/connectors/databricks/meta'
 import { discordConnectorMeta } from '@/connectors/discord/meta'
@@ -81,6 +82,7 @@ export const CONNECTOR_META_REGISTRY: ConnectorMetaRegistry = {
   box: boxConnectorMeta,
   circleback: circlebackConnectorMeta,
   clickup: clickupConnectorMeta,
+  coda: codaConnectorMeta,
   confluence: confluenceConnectorMeta,
   databricks: databricksConnectorMeta,
   discord: discordConnectorMeta,
diff --git a/apps/sim/connectors/source-error.ts b/apps/sim/connectors/source-error.ts
index 09e0c854e7f..37e28189674 100644
--- a/apps/sim/connectors/source-error.ts
+++ b/apps/sim/connectors/source-error.ts
@@ -21,3 +21,6 @@ export class ConnectorSourceError extends Error {
 
 /** Keeps directory failures distinct from document-content failures through cause wrapping. */
 export class ConnectorDirectoryError extends Error {}
+
+/** A provider-confirmed inaccessible external group, rather than a directory-wide failure. */
+export class ConnectorDirectoryGroupAccessError extends ConnectorDirectoryError {}
diff --git a/apps/sim/connectors/types.ts b/apps/sim/connectors/types.ts
index 42636ada4f2..9586bad3c79 100644
--- a/apps/sim/connectors/types.ts
+++ b/apps/sim/connectors/types.ts
@@ -182,9 +182,18 @@ export interface ExternalDocument {
   metadata?: Record<string, unknown>
 }
 
-/**
- * Paginated result from listing documents in an external source.
- */
+/** Bounded provider evidence for scopes that could not be fully listed. */
+export interface ExternalListingFailures {
+  count: number
+  samples: {
+    scope: string
+    operation: string
+    status?: number
+    reasons: string[]
+  }[]
+}
+
+/** Paginated result from listing documents in an external source. */
 export interface ExternalDocumentList {
   documents: ExternalDocument[]
   nextCursor?: string
@@ -197,6 +206,8 @@ export interface ExternalDocumentList {
    * provider pagination must set this to false.
    */
   reconciliationSafe?: boolean
+  /** Cumulative, bounded failure evidence for this listing generation; replay must not add it twice. */
+  listingFailures?: ExternalListingFailures
 }
 
 /**
diff --git a/apps/sim/content/library/ai-agent-examples-by-department-and-industry/index.mdx b/apps/sim/content/library/ai-agent-examples-by-department-and-industry/index.mdx
new file mode 100644
index 00000000000..f03410d6874
--- /dev/null
+++ b/apps/sim/content/library/ai-agent-examples-by-department-and-industry/index.mdx
@@ -0,0 +1,167 @@
+---
+slug: ai-agent-examples-by-department-and-industry
+title: 'AI Agent Examples by Department and Industry: A Practical Roundup'
+description: 'A practical roundup of AI agent examples across sales, support, operations, engineering, marketing, HR, and five industries, with build patterns for Sim.'
+date: 2026-09-17
+updated: 2026-09-17
+authors:
+  - andrew
+readingTime: 16
+tags: [AI Agents, Workflow Automation, Industry Use Cases, Sim]
+ogImage: /library/ai-agent-examples-by-department-and-industry/cover.jpg
+canonical: https://www.sim.ai/library/ai-agent-examples-by-department-and-industry
+draft: false
+faq:
+  - q: "How does an AI agent differ from a chatbot or RAG bot?"
+    a: "A chatbot or RAG bot retrieves information and generates a response. An AI agent can also call tools, evaluate results, and complete actions such as updating a ticket or issuing an approved refund."
+  - q: "What does Mothership orchestration or multi-agent coordination mean in practice?"
+    a: "In Sim’s Mothership orchestration, a coordinator assigns parts of a larger task to specialized agents and passes outputs between them. For example, one agent researches a lead, another drafts outreach, and a coordinator sends qualified results to the CRM."
+  - q: "Do these AI agent examples require coding?"
+    a: "Many examples can use visual blocks, integrations, and prompts without custom code. Sim supports visual, conversational, and code-based building, while custom APIs or unusual business rules may require a function block or developer support."
+  - q: "How do you enforce human oversight?"
+    a: "Approval steps pause an agent before refunds, candidate decisions, account changes, or other consequential actions. Guardrails can restrict which tools an agent may call and enforce approved spending limits. Run logs record the actions taken for later review."
+---
+
+## TL;DR
+
+- A support agent can start when Zendesk receives a ticket, search the knowledge base, check Salesforce and Jira, then set the priority, route the ticket, and send a status reply. [Each tool call advances the task](https://composio.dev/content/ai-agents-customer-support-use-cases).
+- AI agents respond to triggers, gather context, choose actions, and use connected tools. Human approval can protect consequential actions such as refunds or candidate decisions.
+- The roundup groups examples by six departments and five industries. Each example includes a version you can build in [Sim](https://www.sim.ai/) with Agent blocks, connected workflows, and review steps.
+
+## What an AI agent example actually looks like
+
+An AI agent receives a trigger, evaluates available context, chooses a next step, and uses tools to complete work. For example, a support agent can receive a new Zendesk ticket, search internal documentation, and check the customer’s account in Salesforce. The agent can then search Jira for related bugs before updating and routing the ticket. A fixed workflow can call the same tools, but predefined rules determine every step.
+
+A chatbot usually retrieves information and generates a response. Retrieval-augmented generation, or RAG, lets the chatbot search a knowledge base before answering. An agent can continue when the knowledge base lacks a complete answer. It can call external systems, compare their results, and execute a multi-step task such as issuing a refund after approval. [Customer support agents commonly use tool calling](https://composio.dev/content/ai-agents-customer-support-use-cases) to perform these actions across ticketing, billing, and engineering systems. For a closer comparison, see [AI agent vs. chatbot](https://www.sim.ai/library/ai-agent-vs-chatbot).
+
+Invoice processing provides another useful distinction. OCR software extracts vendor names, amounts, and line items from a document. An invoice agent compares those fields with purchase orders and receipts, then evaluates why records differ. For example, the agent might identify a partial delivery rather than merely flagging an amount mismatch. Invoice agents can route uncertain or exceptional cases to a reviewer with the relevant records attached.
+
+The examples in this roundup follow a recurring pattern. A trigger starts the job, the agent gathers context, and tool calls perform an action. A human-in-the-loop checkpoint controls sensitive or irreversible decisions. In [Sim](https://sim.ai), an Agent block handles reasoning, a knowledge base supplies trusted context, and workflows connect triggers, tools, actions, and review steps. The guide to [what an AI agent is](https://www.sim.ai/library/what-is-an-ai-agent-definition-how-it-works-and-examples) explains these components in more detail.
+
+## AI agent examples by department
+
+The following examples show how sales, support, operations, engineering and IT, marketing, and HR departments can use agents. Each section also explains how to build the pattern in [Sim](https://sim.ai) with Agent blocks, connected workflows, and human review steps.
+
+### Sales: outbound prospecting and inbound lead qualification agents
+
+Outbound prospecting agents turn a target account profile into a researched outreach sequence. The agent finds matching companies, enriches each contact with CRM and external data, and researches recent signals such as hiring activity or company news. It then drafts a message based on those signals and sends follow-ups through approved channels. [Outbound sales agents](https://www.11x.ai/guides/ai-sales-agents) can apply this process across channels such as email, LinkedIn, SMS, and voice.
+
+Inbound qualification agents respond when a prospect submits a form, starts a chat, or calls. The agent identifies the account, retrieves relevant CRM records, and asks questions about need and timing. A scoring rule then compares the answers with a marketing-qualified lead threshold. Qualified describes an agent that pursues leads meeting a defined threshold and [books meetings for sales representatives](https://www.qualified.com/ai-sdr-agents). Lower-scoring leads can enter a nurture sequence instead of taking a representative’s time.
+
+You can build either pattern as a [Sim workflow](https://www.sim.ai/) with a trigger feeding an Agent block. For outbound sales, the Agent block researches and enriches each lead, then writes structured results to a Table. A workflow branch can send approved contacts to sequencing actions while routing uncertain records to a person for review.
+
+For inbound sales, the Agent block can evaluate submitted details against your qualification criteria. The workflow can update the CRM and notify a representative when a lead crosses the threshold. Human representatives retain control over high-value conversations, while the agent handles research, scoring, routing, and scheduling.
+
+### Support: tiered triage and agent-assist agents
+
+A tiered triage agent classifies each new support ticket, gathers account context, and sends the issue to the right queue. For example, a Zendesk webhook can trigger an agent that checks Salesforce for the customer’s service tier and searches Jira for related bugs. If the agent finds a matching high-priority incident, it can tag the ticket, attach the Jira issue, raise the priority, and route the customer directly to engineering. [Tool-calling agents can complete these steps across support, CRM, and bug-tracking systems](https://composio.dev/content/ai-agents-customer-support-use-cases), while a standard chatbot usually stops after retrieving an answer.
+
+An agent-assist workflow gives support representatives similar tool access without allowing autonomous financial actions. When a representative requests a refund, the agent can retrieve the customer’s invoices, inspect the relevant charge, and calculate the exact credit. The workflow then presents the amount and payment details for confirmation. Only an approved request reaches the refund action, and the agent can draft a customer reply after the payment system confirms the transaction.
+
+Place human approval immediately before an agent takes a consequential or difficult-to-reverse action. Examples include issuing a refund, cancelling an account, changing an entitlement, or sending a binding response. Classification and context gathering can run automatically when a reviewer can correct their outputs before execution. See [what human in the loop means for AI agents](https://www.sim.ai/library/what-is-human-in-the-loop-in-ai-agents) for more approval patterns.
+
+In [Sim](https://sim.ai), an Agent block can classify the ticket and enrich it with CRM or bug-tracker data. Workflow branches can route routine questions to support and known incidents to engineering. A Human in the Loop block can pause refund execution and request approval through a connected channel or webhook. Sim’s run logs then record the blocks, actions, costs, and failures associated with each support request.
+
+### Operations: invoice processing and document triage agents
+
+An accounts payable agent follows an extract, match, and flag pattern. The agent reads an invoice, converts line items into structured fields, and compares them with purchase orders and receiving records. Clean matches can move toward payment, while exceptions go to a reviewer with the relevant documents and discrepancy already identified.
+
+An agent can evaluate relationships among extracted fields that optical character recognition alone only captures. OCR can capture a total or invoice number, but an agent can examine whether a mismatch comes from a quantity difference, an added fee, or conflicting tax information. The agent can also attach confidence scores to extracted fields and route uncertain values for review.
+
+You can build the same pattern in [Sim](https://www.sim.ai/) with an Agent block that reads uploaded invoices or uses reference documents stored in a Knowledge Base. A workflow can retrieve the matching purchase order, compare fields, and branch according to confidence and discrepancy thresholds. A Human in the Loop step can require approval when extraction confidence falls below the chosen threshold or when totals do not match. Approved invoices continue to the accounting system, while rejected cases return to the reviewer with the source fields and comparison attached.
+
+### Engineering and IT: helpdesk triage and code-assist agents
+
+A helpdesk triage agent resolves routine requests and sends complex cases to an engineer with the relevant context attached. The agent classifies each ticket, checks an internal knowledge base, and calls approved tools for tasks such as credential resets or access changes. When escalation becomes necessary, the agent includes the user’s device details, previous fixes, and any failed actions so the engineer does not repeat the intake work.
+
+[Bank of America reports](https://newsroom.bankofamerica.com/content/newsroom/press-releases/2025/04/ai-adoption-by-bofa-s-global-workforce-improves-productivity--cl.html) that more than 90 percent of its employees use its internal virtual assistant for HR, payroll, benefits, and IT questions, while service desk calls have fallen by more than 50 percent. The deployment illustrates how an assistant can handle routine requests while people retain responsibility for exceptions.
+
+Coding agents apply a similar model to repetitive engineering work. A coding agent can inspect a repository, generate replacement modules, and run tests, but an engineer should review proposed changes before merging or deployment.
+
+You can build the helpdesk pattern with a [Sim workflow](https://www.sim.ai/) that sends each incoming ticket to an Agent block. The agent routes the request by type and calls approved integrations. A Guardrails or Evaluator block can check the proposed response and tool output before the workflow closes a ticket. Low-confidence answers, failed tool calls, and sensitive access requests should route to a human reviewer instead.
+
+### Marketing: content and research agents
+
+The marketing patterns below are illustrative workflows rather than documented deployments. Each starts with a defined trigger and uses context, model judgment, and tool calls to complete a specific task.
+
+A content repurposing agent can start when you upload a webinar transcript or publish a new article. The agent retrieves approved messaging and brand guidance, then identifies reusable claims. A workflow can produce a blog draft or social post based on the selected channel. A marketer reviews each draft before publication.
+
+An SEO research agent can run when you submit a topic or on a recurring schedule. It calls search and analytics tools, compares ranking pages with your existing coverage, and produces a brief with suggested questions and source material. A social listening agent follows a similar pattern. It monitors incoming mentions, groups related comments, checks known issues, and routes urgent items to the appropriate owner.
+
+In [Sim](https://www.sim.ai/), an Agent block can draw context from a Knowledge Base containing brand assets and approved content. Workflow branches can format the agent’s output for different channels, while a review step prevents unapproved claims or off-brand copy from reaching publication.
+
+### HR: resume screening and onboarding agents
+
+Resume agents should automate document intake while leaving candidate decisions to a recruiter. An agent can monitor an approved inbox or form, separate attachments, extract fields such as role, location, and experience, and flag missing information. The agent then writes structured records to an applicant tracking system or review queue. A human should decide whether a candidate advances.
+
+Employment laws can limit how much authority you give the agent. [New York City’s Local Law 144 requires](https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page) bias audits, public summaries, and notices for covered automated employment decision tools. The [Illinois Artificial Intelligence Video Interview Act requires](https://www.ilga.gov/documents/legislation/ilcs/documents/082000420K5.htm) notice, an explanation, and consent before AI analyzes covered video interviews. Colorado has also enacted consumer protections concerning algorithmic discrimination in consequential decisions made by high-risk AI systems; verify the [current Colorado Attorney General guidance](https://coag.gov/ai/) before deployment because the statutory framework continues to change. Applicable law and the agent’s role in the employment decision should determine its permitted actions. Obtain legal review before using an agent to evaluate candidates or make employment recommendations.
+
+Onboarding agents can handle more of the workflow because a person has already approved the hire. A signed offer can trigger document generation, signature requests, and IT or facilities tickets. The agent can notify each owner as prerequisites finish. A location change, failed background check, delayed start, or missing signature should stop the workflow and route the case to a named person rather than prompt the agent to improvise.
+
+In [Sim](https://www.sim.ai/), an Agent block can receive documents and extract the required fields. A Human in the Loop step can gate every action that affects a candidate, while workflow branches can apply the correct onboarding sequence for each role or region. Run logs can record completed actions, failures, and approvals for later review.
+
+## AI agent examples by industry
+
+The following examples apply agent patterns to ecommerce, healthcare, finance, SaaS, and real estate. Each section explains how to build the pattern in [Sim](https://sim.ai) with Agent blocks, connected tools, workflows, and human review steps.
+
+### Ecommerce: shopping support and merchandising agents
+
+Ecommerce agents commonly handle either customer support or merchandising decisions. A support agent receives an order question, identifies the customer, checks the live order system, and returns the current status. For returns, the agent checks the purchase date and policy before approving an eligible request or routing an exception to a person.
+
+Klarna shows both the value and the limit of this approach. [Klarna reported](https://www.klarna.com/international/press/klarna-ai-assistant-handles-two-thirds-of-customer-service-chats-in-its-first-month/) that its AI assistant handled 2.3 million conversations in one month, reduced resolution time from 11 minutes to under two, and lowered repeat inquiries by 25 percent. Routine questions fit automation better than ambiguous complaints or unusual refund requests.
+
+Merchandising agents can adjust product placement or pricing within limits set by a person. A personalization agent can select products or homepage modules based on browsing behavior and customer segment. A pricing agent can respond to inventory levels and competitor changes, but human-set limits should prevent excessive discounts or sudden price jumps.
+
+You can build the support pattern in [Sim](https://www.sim.ai/) with an Agent block grounded in a Knowledge Base of return policies and product information. The workflow can call the order system for live shipment or purchase data. Guardrails can restrict refunds and discounts to approved limits, while a review step sends exceptions to a support agent before any irreversible action.
+
+### Healthcare: prior authorization and intake agents
+
+A prior authorization agent prepares payer submissions when an electronic health record flags an order that requires approval. The agent retrieves clinical notes and test results, checks them against payer requirements, and packages the supporting documents. After a denial, it reads the payer’s explanation, identifies missing evidence, and drafts a corrected appeal for review.
+
+Prior authorization requires substantial administrative work and can delay care. An [American Medical Association survey](https://www.ama-assn.org/system/files/prior-authorization-survey.pdf) reports that physicians and their staff spend more than 13 hours each week completing prior authorizations and that 95 percent of surveyed physicians report care delays.
+
+A patient intake agent gathers symptoms through chat, voice, or a form and evaluates the answers against approved clinical protocols. The agent assigns an urgency level, sends high-risk responses to a clinician, and routes suitable cases to scheduling. It can then check provider availability, book appointments, send reminders, and offer cancelled slots to patients on a waitlist. A clinician should review ambiguous or urgent cases rather than letting the agent make an independent medical judgment.
+
+You could build the prior authorization pattern in [Sim](https://www.sim.ai/) with an Agent block that retrieves payer criteria from a Knowledge Base and collects patient documents through approved integrations. A human approval checkpoint can pause the workflow before submission or resubmission. Sim’s block-level logs record actions, costs, and failures, which gives reviewers a trace of each run and helps you investigate errors. Patient intake can use a similar workflow, with separate branches for routine scheduling and clinician review.
+
+### Finance: fraud detection and compliance monitoring agents
+
+A fraud detection agent monitors transaction feeds, evaluates activity across channels, and opens an investigation case when behavior meets defined risk criteria. The case can include the triggering transactions, account history, and the agent’s reason for escalation. An analyst then decides whether to block activity, contact the customer, or file a report.
+
+Compliance agents apply a similar pattern to internal controls and financial reporting. An agent can screen transactions against sanctions lists, flag expense policy violations, or investigate differences between actual spending and forecasts. Variance agents gather the relevant records and surface likely causes, which reduces the manual work required before review. Human reviewers should retain control over regulatory filings and other consequential actions.
+
+A [Sim workflow](https://www.sim.ai/) could use a scheduled trigger to poll a transaction or accounting feed at frequent intervals. An Agent block would assess each record against policies and available account context, while an integration action would open a case in the relevant ticketing or investigation tool. Sim logs each run block by block, including actions and failures. Retained logs can show reviewers what the agent evaluated and which actions it took, while approval records identify where a person intervened.
+
+### SaaS: onboarding and usage-signal agents
+
+The SaaS pattern below is an illustrative workflow rather than a documented case study. It adapts the pattern of onboarding agents that coordinate task lists and reminders based on role or region to customer activity inside a software product.
+
+A SaaS onboarding agent starts when a customer creates an account or reaches a scheduled checkpoint. The agent reads the customer’s plan, role, completed setup actions, and recent usage. It then selects a relevant next step, such as connecting a data source or inviting a colleague, and sends the instruction through an in-app message or email.
+
+Usage signals can also identify accounts that may need human attention. For example, an agent could detect when active seats reach 80 percent of purchased capacity. Rather than contacting the customer with an automatic sales pitch, the agent could summarize adoption patterns and route the account to a representative.
+
+In [Sim](https://www.sim.ai/), a scheduled workflow can supply product events to an Agent block through a Table. The agent evaluates each account against onboarding rules and usage thresholds. A workflow branch then sends an in-app nudge when the customer needs guidance or hands the account to a human when usage crosses the chosen threshold.
+
+### Real estate: lead qualification and maintenance triage agents
+
+Real estate agents can handle narrowly defined requests that end with a clear handoff to a broker, property manager, or vendor. A lead qualification agent asks an inbound buyer about budget, preferred area, purchase timeline, and financing status. Based on the answers, it can ask follow-up questions, check calendar availability, and book a showing for a qualified buyer. The agent routes uncertain or high-value leads to a human agent with the conversation attached.
+
+A maintenance triage agent follows a similarly short path. The agent collects the property address, issue description, urgency, and access details. It then categorizes the request, creates a ticket, and dispatches the appropriate vendor. Emergency conditions and unclear requests can trigger a property manager review before dispatch.
+
+You can build either pattern in [Sim](https://www.sim.ai/) with an Agent block handling the conversation and a workflow action completing the handoff. The lead workflow can book a calendar slot or update a CRM. The maintenance workflow can send a ticket to a vendor system. Both workflows limit the agent to a narrow decision followed by a defined CRM, calendar, or vendor-system action.
+
+## Choosing a pattern versus building it yourself
+
+Evaluate a workflow builder when you can map the job as a mostly predictable sequence. Compare [n8n](https://docs.n8n.io/build/flow-logic) and Make for processes built around branches and error handling. Make documents both [branching with routers](https://help.make.com/router) and [scenario error handling](https://help.make.com/Overview-of-error-handling). Consider [Gumloop](https://docs.gumloop.com/nodes/web_scraping/website_scraper) for browser automation and data-heavy flows. In each case, confirm current product capabilities and deployment requirements before choosing a tool.
+
+Evaluate a packaged assistant when the job resembles personal or executive assistance. Compare Lindy for [scheduling](https://docs.lindy.ai/features/meeting-assistant/scheduling) and [inbox tasks](https://docs.lindy.ai/skills/popular-integrations/gmail) with [Zapier Agents](https://zapier.com/agents) for assistant features connected to app automation. Verify the integrations, controls, and setup requirements that your workflow needs.
+
+An open agent workspace fits a use case that requires custom instructions, company knowledge, model choice, or access to several tools. [Sim](https://www.sim.ai/) provides Agent blocks for individual reasoning tasks and workflows for connecting those tasks to integrations, code, data, and approval steps. Sim’s Mothership orchestration can coordinate specialized agents when a workflow needs to delegate work or combine agent outputs. Read [AI agent orchestration frameworks explained](https://www.sim.ai/library/ai-agent-orchestration-frameworks-explained) for the underlying coordination patterns.
+
+The use case should determine the category. A fixed invoice-routing sequence may need a workflow builder, while a research agent that delegates analysis and drafting may benefit from multi-agent coordination. Coding requirements also vary. Visual builders reduce setup work, while code and self-hosting options give you more control over custom behavior and deployment.
+
+## Conclusion
+
+A practical AI agent needs a defined task boundary. Use a narrow trigger, give the agent access only to the context and tools it needs, and require human approval before consequential actions.
+
+Start with one recurring task and define its trigger, required context, permitted tools, and approval point. Build the narrowest useful version first, then review its run logs to identify which steps can remain automated and which require human judgment.
diff --git a/apps/sim/content/library/ai-native-workflow-automation-vs-traditional-automation/index.mdx b/apps/sim/content/library/ai-native-workflow-automation-vs-traditional-automation/index.mdx
new file mode 100644
index 00000000000..40219c9afe0
--- /dev/null
+++ b/apps/sim/content/library/ai-native-workflow-automation-vs-traditional-automation/index.mdx
@@ -0,0 +1,333 @@
+---
+slug: ai-native-workflow-automation-vs-traditional-automation
+title: 'AI-Native Workflow Automation vs Traditional Automation Platforms'
+description: 'Compare AI-native workflow automation with traditional platforms such as Zapier, Make, and n8n across architecture, adaptability, reliability, licensing, and use cases.'
+date: 2026-09-17
+updated: 2026-09-17
+authors:
+  - andrew
+readingTime: 13
+tags: [AI Agents, Workflow Automation, Platform Comparison, Open Source, Sim]
+ogImage: /library/ai-native-workflow-automation-vs-traditional-automation/cover.jpg
+canonical: https://www.sim.ai/library/ai-native-workflow-automation-vs-traditional-automation
+draft: false
+faq:
+  - q: "How do AI-native workflow automation platforms compare to traditional automation tools like Zapier?"
+    a: "AI-native platforms such as Sim use models and agents for runtime interpretation and decisions, while traditional tools such as Zapier primarily execute predefined triggers, actions, and branches."
+  - q: "What is the main difference between AI-native automation and traditional automation?"
+    a: "Sim makes reasoning a core workflow capability, while traditional automation platforms make explicit rules and predefined application actions the core workflow capability."
+  - q: "Is Zapier an AI-native automation platform?"
+    a: "Zapier offers AI features, but Zapier remains primarily centered on managed trigger-action automation rather than model-driven reasoning as the default workflow architecture."
+  - q: "Does Zapier use AI?"
+    a: "Zapier uses AI in product features and workflow steps, but Zapier’s use of AI does not make every Zap an agentic or AI-native workflow."
+  - q: "Can Make handle AI workflows?"
+    a: "Make can handle AI workflows through supported services and modules, but Make’s visual scenario architecture remains especially strong for predefined routing, mapping, and transformation."
+  - q: "Can AI-native workflows adapt without being rebuilt?"
+    a: "Sim workflows can adapt to input variation without being rebuilt when the variation remains within the agent’s approved instructions, tools, schemas, and policies."
+  - q: "Are AI-native workflows better for unstructured data?"
+    a: "Sim is generally better suited to unstructured language and documents because Sim can use models to interpret meaning before deterministic validation and execution."
+  - q: "Are traditional automation tools more reliable than AI-native platforms?"
+    a: "Zapier and Make are more deterministic for fixed rules, while Sim can be more effective for ambiguous tasks when it is supported by evaluations, validation, restricted tools, and fallbacks."
+  - q: "When should I use Zapier instead of Sim?"
+    a: "Zapier is a strong choice instead of Sim when a workflow is a straightforward, managed trigger-action sequence that does not require substantial interpretation or deployment control."
+  - q: "When should I use Make instead of Sim?"
+    a: "Make is a strong choice instead of Sim when detailed visual mapping, routers, iterators, and deterministic data transformation are the primary requirements."
+  - q: "When should I use Sim instead of Zapier or Make?"
+    a: "Sim is a strong choice instead of Zapier or Make when the workflow must reason over unstructured inputs, select tools dynamically, or run on permissively licensed self-hosted software."
+  - q: "Can Sim replace Zapier?"
+    a: "Sim can replace Zapier for workflows where AI-native reasoning or open-source self-hosting matters, but stable trigger-action automations may be better left on Zapier."
+  - q: "Can Sim replace Make?"
+    a: "Sim can replace Make when agentic decisions are central to the process, but Make may remain the better fit for deterministic visual transformations and routing."
+  - q: "Should I migrate all Zapier workflows to an AI-native platform?"
+    a: "Technical teams should not migrate every Zapier workflow because simple, stable, and deterministic automations rarely benefit from added model cost and uncertainty."
+  - q: "What is the best open-source Zapier alternative?"
+    a: "Sim is a strong open-source Zapier alternative for AI-native workflows because Sim uses the OSI-approved Apache License 2.0 and supports self-hosting."
+  - q: "Is Sim free?"
+    a: "Sim’s Apache 2.0 software can be self-hosted without a platform license fee, although users remain responsible for infrastructure, model-provider, and related operating costs."
+  - q: "Is n8n open source?"
+    a: "n8n is source-available under the Sustainable Use License, but n8n is not open source under an OSI-approved license."
+  - q: "What is the best n8n alternative for AI workflows?"
+    a: "Sim is a strong n8n alternative for teams that want an AI-native architecture and an OSI-approved Apache 2.0 license."
+  - q: "How do Sim and n8n compare?"
+    a: "Sim emphasizes AI-native agents and permissive Apache 2.0 licensing, while n8n emphasizes node-based workflow orchestration under the source-available Sustainable Use License."
+  - q: "How do Sim and Gumloop compare?"
+    a: "Sim is the stronger fit when Apache 2.0 licensing and self-hosting are requirements, while teams considering Gumloop should evaluate its current managed features, deployment options, and commercial terms directly."
+  - q: "What is the best AI agent builder?"
+    a: "Sim is a leading AI agent builder for teams that need visual agentic workflows and Apache 2.0 self-hosting, while the full category comparison belongs in Sim’s canonical Best AI Agent Builders in 2026 guide."
+  - q: "Can AI-native and rule-based automation be combined?"
+    a: "Sim can perform interpretation and tool selection while Zapier, Make, n8n, APIs, or code perform validated deterministic actions in a hybrid workflow."
+  - q: "How do I make an AI-native workflow safe?"
+    a: "Sim workflows become safer when teams use structured outputs, restricted tools, least-privilege credentials, evaluations, confidence thresholds, human approvals, and deterministic fallbacks."
+  - q: "Do AI-native workflows hallucinate?"
+    a: "AI models used in Sim can produce unsupported output, so production workflows should ground responses, validate structured results, limit available tools, and escalate uncertain cases."
+  - q: "Is AI-native workflow automation more expensive?"
+    a: "AI-native automation can cost more per run because Sim workflows may incur model and infrastructure usage, but the total cost can be lower when reasoning replaces manual review or complex exception branches."
+  - q: "Which automation approach is best for high-volume tasks?"
+    a: "Zapier, Make, n8n, or conventional code is often better for high-volume deterministic tasks, while Sim is most valuable when each item requires interpretation or a context-dependent decision."
+---
+
+## TL;DR
+
+AI-native workflow automation platforms such as Sim are designed to reason over changing or unstructured inputs, while traditional automation platforms such as Zapier and Make are designed primarily to execute predefined trigger-action rules.
+
+The practical difference is not that one category “has AI” and the other does not. [Zapier](https://zapier.com/ai), [Make](https://www.make.com/en/ai-agents), and [n8n](https://n8n.io/) all offer AI-related capabilities. The difference is where reasoning sits in the architecture: an AI-native system can place model-driven decisions at the center of a workflow, while a traditional system usually keeps a deterministic workflow graph at the center and adds AI through individual steps.
+
+For technical teams, the choice comes down to the work being automated. Traditional automation remains a strong fit for stable, repetitive processes. AI-native automation is usually a better fit when a workflow must interpret language, extract meaning, select tools, or adapt its next action at runtime. For adjacent decision frameworks, see the [AI workflow automation platform buyer’s checklist](https://www.sim.ai/library/ai-workflow-automation-platform-buyers-checklist) and the guide to [how AI agents make decisions versus rule-based systems](https://www.sim.ai/library/how-ai-agents-make-decisions-vs-rule-based-systems).
+
+## How do AI-native workflow automation platforms compare to traditional automation tools like Zapier?
+
+AI-native platforms such as Sim are better suited to workflows that require interpretation and runtime decision-making, while traditional platforms such as [Zapier, whose Paths feature encodes conditional outcomes](https://zapier.com/features/paths), are better suited to workflows whose inputs, rules, and outputs can be defined in advance.
+
+A traditional automation might express a process as:
+
+1. When a form is submitted, create a CRM record.
+2. If the deal size exceeds a threshold, notify a sales channel.
+3. Otherwise, add the lead to an email sequence.
+
+An AI-native workflow can handle a less structured objective:
+
+1. Read an inbound email and its attachments.
+2. Determine the sender’s intent and urgency.
+3. Extract the relevant account, product, and commercial details.
+4. Decide whether to answer, request missing information, update a system, or escalate to a person.
+5. Use the appropriate tools while respecting approval and access rules.
+
+The second workflow still needs deterministic controls. The distinction is that an AI model or agent can choose among permitted actions instead of following only branches that a developer enumerated beforehand.
+
+| Evaluation area | AI-native workflow automation | Traditional workflow automation |
+|---|---|---|
+| Core abstraction | Goals, agents, models, tools, memory, and guardrails | Triggers, actions, filters, routers, and fixed branches |
+| Best input type | Natural language, documents, conversations, images, and variable payloads | Structured records, events, fields, and predictable API payloads |
+| Decision-making | Model-driven decisions can be made at runtime | Decisions are primarily encoded as explicit rules |
+| Adaptability | Can accommodate variation within defined tools and policies | Usually requires a new condition, mapping, or branch for new cases |
+| Predictability | Requires evaluation, confidence thresholds, and fallbacks | Highly predictable when APIs and input schemas remain stable |
+| Observability | Must capture model inputs, outputs, tool calls, and decisions | Usually focuses on step status, field values, retries, and API errors |
+| Cost profile | Includes model usage, workflow execution, and infrastructure costs | Usually centers on tasks, operations, credits, executions, or plan limits |
+| Strongest use case | Knowledge work with ambiguous or unstructured inputs | Repetitive, high-volume, deterministic system-to-system work |
+
+## What is an AI-native workflow automation platform?
+
+An AI-native workflow automation platform such as Sim treats models, agents, tool use, and runtime reasoning as primary workflow components rather than optional add-ons.
+
+An AI-native platform should make it possible to:
+
+- Send natural-language or multimodal input to models.
+- Give an agent a constrained set of tools.
+- Use structured outputs to connect probabilistic reasoning to deterministic systems.
+- Add retrieval, memory, approvals, and policy checks where needed.
+- Inspect model responses and tool calls during testing and production runs.
+- Combine agentic decisions with ordinary code, API, and data-processing steps.
+
+AI-native does not mean that every step should be nondeterministic. Reliable AI-native workflows usually surround model-driven steps with schemas, validation, permission boundaries, retries, timeouts, and human approval for consequential actions.
+
+## What is a traditional workflow automation platform?
+
+A traditional workflow automation platform such as [Zapier](https://zapier.com/features/paths) or [Make](https://www.make.com/en/how-to-guides/control-your-workflows) connects applications through predefined triggers, actions, mappings, conditions, and branches.
+
+This architecture works especially well when a team can specify exactly what should happen. A new CRM record can trigger an enrichment request, a database update, and a notification without requiring an AI model to interpret the event.
+
+Traditional automation has important advantages:
+
+- The same inputs generally follow the same path.
+- Rules are easy to inspect when workflows remain small.
+- Structured data can move between systems without model latency.
+- Teams do not need to evaluate model quality for straightforward mappings.
+- High-volume repetitive jobs do not incur unnecessary inference costs.
+
+Traditional platforms can also call language models. Adding an AI step, however, does not automatically make the surrounding workflow AI-native. A fixed graph that sends text to a model and then resumes a predetermined sequence is still primarily a rule-based automation.
+
+## What is the architectural difference between AI-native and rule-based automation?
+
+Sim places model-driven reasoning and tool selection inside the workflow architecture, while [Zapier’s conditional Paths](https://zapier.com/features/paths) and [Make’s workflow tools](https://www.make.com/en/how-to-guides/control-your-workflows) center a workflow on author-defined application actions.
+
+The architectural difference appears in four places.
+
+### How is the next action selected?
+
+Sim can allow a constrained agent to select an appropriate tool at runtime, while Zapier and Make commonly use branches that the workflow author defines in advance.
+
+A fixed branch might say, “If category equals billing, create a finance ticket.” An agentic decision might ask a model to classify an unfamiliar request, identify missing context, and choose among approved support, billing, or escalation tools.
+
+### How is unstructured input handled?
+
+Sim can use models to interpret unstructured input before passing validated data into deterministic steps, while traditional tools work most naturally with known fields and schemas.
+
+A rule-based workflow can process documents if templates and extraction rules are stable. An AI-native workflow becomes more useful when document layouts, vocabulary, requests, or required actions vary from case to case.
+
+### How does the workflow adapt?
+
+Sim can adapt within a defined set of instructions, tools, and policies, while traditional workflows generally adapt only through conditions explicitly added by their authors.
+
+This does not mean an AI-native workflow can safely handle every unforeseen situation. It means the workflow can reason across expected variation without requiring a separate branch for every wording or document format.
+
+### How is reliability enforced?
+
+Sim requires model evaluations and agent guardrails in addition to ordinary workflow testing, while deterministic workflows can rely more heavily on step and integration testing.
+
+AI-native reliability should include structured outputs, tool restrictions, test datasets, confidence thresholds, approval gates, trace review, and deterministic fallbacks. Traditional reliability should include schema validation, idempotency, retries, error handling, and monitoring. Production systems often need both sets of controls.
+
+## Can AI-native automation handle unstructured data better than Zapier or Make?
+
+AI-native platforms such as Sim generally handle variable natural-language and document inputs more directly than rule-based workflows in Zapier or Make.
+
+Examples include:
+
+- Classifying support requests that do not follow a standard form.
+- Extracting obligations and dates from differently formatted contracts.
+- Comparing a customer’s request with internal policy documents.
+- Summarizing a conversation and selecting an appropriate next action.
+- Turning meeting notes into updates across several business systems.
+- Researching a topic with approved tools and producing a structured result.
+
+[Zapier can add AI within workflows](https://zapier.com/ai), and [Make offers AI agents in its visual platform](https://www.make.com/en/ai-agents). The tradeoff is architectural: as interpretation becomes the core of the process, a workflow built mainly from fixed steps can accumulate prompts, routers, parsers, and exception branches that are harder to maintain.
+
+## Can AI-native workflows adapt without being rebuilt?
+
+Sim workflows can adapt to variation without a full rebuild when the variation falls within the agent’s approved instructions, tools, schemas, and policies.
+
+For example, a Sim workflow could receive several kinds of account requests, determine which internal system contains the answer, and call the relevant approved tool. A traditional implementation may need separate routing conditions for every supported request type.
+
+AI-native adaptability still has boundaries. A new compliance policy, external system, permission, or business objective may require an explicit workflow update. AI-native automation reduces the need to encode every linguistic variation; it does not remove the need for workflow governance.
+
+## When do traditional automation tools like Zapier and Make work better?
+
+Zapier and Make work better when a process is stable, deterministic, structured, and valuable mainly because it executes reliably at scale.
+
+Strong traditional-automation use cases include:
+
+- Copying new form submissions into a CRM.
+- Synchronizing known fields between databases.
+- Sending scheduled reports.
+- Creating invoices from validated order records.
+- Routing notifications according to explicit thresholds.
+- Updating spreadsheets after a predictable application event.
+- Running high-volume transformations that do not require interpretation.
+
+Using an AI model for these jobs can add latency, cost, and failure modes without improving the result. If a condition can be expressed safely as code or a rule, it usually should be.
+
+[Zapier provides managed application connections and trigger-action automation](https://zapier.com/), making it approachable for teams seeking straightforward recipes. [Make’s official guides describe visual scenarios, modules, triggers, iterators, and transformations](https://www.make.com/en/how-to-guides/how-to-use-iterator-array-aggregator-in-make), which are useful when teams need detailed mappings and routing. These are legitimate strengths rather than limitations.
+
+## When does an AI-native platform like Sim work better?
+
+Sim works better when the workflow’s central challenge is understanding context and choosing an action rather than merely moving a known field between applications.
+
+Strong AI-native use cases include:
+
+- Triage that depends on meaning, urgency, or policy.
+- Research that requires selecting and combining multiple sources.
+- Document processing across inconsistent formats.
+- Sales or support assistance that uses account context.
+- Internal copilots that can query and update approved systems.
+- Multi-step tasks in which the appropriate next tool depends on an intermediate result.
+- Workflows that need both model reasoning and conventional API or code steps.
+
+Sim is also relevant to teams that prioritize inspectable, self-hostable infrastructure. As of August 2026, [Sim’s repository identifies the project as Apache License 2.0 and documents self-hosting](https://github.com/simstudioai/sim), a permissive open-source license that allows modification.
+
+## Is AI-native workflow automation less reliable than traditional automation?
+
+AI-native workflow automation is less deterministic than a fixed rule graph, but Sim workflows can limit that uncertainty with structured outputs, restricted tools, evaluations, validation, and human approval.
+
+Reliability should be evaluated by task rather than by category. A deterministic workflow is more reliable for copying a known field. An AI-assisted workflow may be more successful when the alternative is a brittle set of keyword rules that cannot understand the input.
+
+Technical teams should measure at least:
+
+- Task completion rate.
+- Correct tool-selection rate.
+- Structured-output validity.
+- Unsupported or fabricated claims.
+- Escalation accuracy.
+- Latency and cost per successful outcome.
+- Recovery from tool and API failures.
+- Performance across a representative evaluation dataset.
+
+Consequential actions should not depend on unconstrained model output. Payments, deletion, access changes, legal commitments, and customer-facing decisions may require deterministic validation or human authorization.
+
+## Should technical teams replace Zapier or Make with an AI-native platform?
+
+Technical teams should replace Zapier or Make only where reasoning, unstructured input, maintainability, deployment control, or agentic tool use creates a material advantage.
+
+A wholesale migration is rarely necessary. Teams can classify existing workflows into three groups:
+
+1. Keep deterministic workflows that are stable and inexpensive.
+2. Rebuild brittle workflows whose many branches are approximating human judgment.
+3. Create hybrid workflows that use AI for interpretation and deterministic steps for execution.
+
+A practical migration candidate often has one or more warning signs:
+
+- Numerous branches exist only to recognize variations in language.
+- People repeatedly correct extracted fields.
+- A process stops whenever an input format changes.
+- Employees must read content before deciding which automation to run.
+- Prompt steps, parsers, and routers have become the majority of the workflow.
+- Self-hosting or source-level control is now a requirement.
+
+The objective should be better automation economics and reliability, not adopting AI for its own sake. Teams evaluating replacements can also compare the [best Zapier alternatives](https://www.sim.ai/library/best-zapier-alternatives).
+
+## How should teams migrate from rule-based automation to AI-native automation?
+
+Sim migrations should begin with one bounded reasoning step rather than an autonomous rewrite of an entire production process.
+
+A safe migration sequence is:
+
+1. Inventory the current trigger, inputs, decisions, actions, owners, and failure paths.
+2. Identify the decision that currently requires human interpretation or excessive branching.
+3. Build a representative dataset of normal, difficult, and adversarial examples.
+4. Ask the model for a structured recommendation before allowing it to take action.
+5. Compare the recommendation with the current workflow or a human reviewer.
+6. Add confidence thresholds, validation, restricted tools, and approval gates.
+7. Permit low-risk actions only after evaluation results meet a defined threshold.
+8. Monitor tool calls, model outputs, cost, latency, and business outcomes.
+9. Keep a deterministic fallback for model, API, and policy failures.
+
+This incremental approach preserves the reliable parts of the existing automation while testing whether model-driven reasoning improves the difficult part.
+
+## Can AI-native and traditional automation work together?
+
+Sim, [Zapier](https://zapier.com/ai), [Make](https://www.make.com/en/ai-agents), and [n8n](https://n8n.io/) can participate in a hybrid architecture in which AI interprets ambiguous inputs and deterministic automation performs validated actions.
+
+A hybrid support workflow could use Sim to interpret a request, retrieve policy context, and produce a structured action recommendation. A deterministic step could then verify required fields, create a ticket, update the CRM, and notify the correct team. High-risk cases could be sent to a human approval queue.
+
+Hybrid design is often the strongest production pattern because it assigns each technology the work it handles best:
+
+- Models interpret, classify, summarize, and propose.
+- Rules validate, constrain, route, and enforce policy.
+- APIs and code execute exact operations.
+- Humans approve consequential or low-confidence decisions.
+
+## How do Sim, Zapier, Make, and n8n compare?
+
+Sim is the most AI-native and permissively licensed option in this comparison, while Zapier and Make emphasize managed automation and n8n combines [self-hostable workflow orchestration](https://docs.n8n.io/deploy/host-n8n/) with AI capabilities.
+
+| Platform | Architectural center | Best fit | Deployment and licensing | Main tradeoff |
+|---|---|---|---|---|
+| Sim | AI agents, models, tools, and workflows | Reasoning-heavy automation, unstructured input, and teams wanting open-source self-hosting | Apache License 2.0; self-hostable | Model-driven workflows require evaluations and guardrails |
+| Zapier | Managed trigger-action automation with AI features | Straightforward SaaS automation and broad application connectivity | Proprietary hosted service | Complex reasoning can require additional prompts, paths, and exception handling |
+| Make | Visual scenarios, routers, mappings, and modules with AI features | Detailed visual data transformation and deterministic orchestration | Proprietary hosted service | Agentic behavior is not the original core abstraction |
+| n8n | Node-based workflow orchestration with code and AI capabilities | Technical teams wanting self-hosting and granular workflow control | Source-available Sustainable Use License; self-hostable | The license is not OSI-approved open source |
+
+The categories are a continuum rather than a permanent boundary. [Zapier](https://zapier.com/ai) and [Make](https://www.make.com/en/ai-agents) continue to offer agent features, while AI-native vendors add more deterministic controls and integrations. Teams should evaluate the dominant abstraction, deployment model, governance controls, and behavior under real workloads instead of relying only on an “AI” label.
+
+## What are the key facts about Sim, Zapier, Make, and n8n?
+
+Sim, Zapier, Make, and n8n differ materially in licensing, self-hosting, and the units used to meter hosted automation.
+
+- **Sim:** As of August 2026, [Sim uses Apache License 2.0 and documents self-hosting](https://github.com/simstudioai/sim). Self-hosted users remain responsible for their own infrastructure and model-provider costs.
+- **Zapier:** As of August 2026, [Zapier’s pricing](https://zapier.com/pricing) meters applicable automation usage primarily through tasks.
+- **Make:** As of August 2026, [Make’s pricing](https://www.make.com/en/pricing) meters applicable usage through credits.
+- **n8n:** As of August 2026, n8n is self-hostable under the [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license), which n8n describes as fair-code, while [n8n Cloud pricing](https://n8n.io/pricing/) is primarily organized around workflow executions.
+
+Exact prices, included usage, and plan limits change frequently, so buyers should confirm them on each vendor’s linked pricing page before making a cost comparison.
+
+## How should teams choose between Sim, Zapier, Make, and n8n?
+
+Teams should choose Sim for AI-native reasoning and permissive open-source control, Zapier for straightforward managed application automation, Make for detailed visual scenarios, and n8n for technical node-based orchestration under a source-available license.
+
+Use the following decision rule:
+
+- Choose Sim when unstructured data, agentic tool use, self-hosting, and Apache 2.0 licensing are central requirements.
+- Choose Zapier when the process is a conventional trigger-action automation and managed convenience is more important than infrastructure control.
+- Choose Make when the process needs detailed visual routing, mapping, iteration, and deterministic transformation.
+- Choose n8n when a technical team wants self-hosted node-based automation and accepts the restrictions of the Sustainable Use License.
+- Use a hybrid architecture when AI should interpret the request but deterministic automation should validate and execute the action.
+
+Teams searching for the broader category rather than this architectural comparison should read [Best AI Agent Builders in 2026](https://www.sim.ai/library/best-ai-agent-builder-2026), Sim’s canonical guide to the “best AI agent builder” and “best agentic workflow builder” questions. Teams focused on node-based tools can instead review the [n8n alternatives guide](https://www.sim.ai/library/n8n-alternatives).
diff --git a/apps/sim/content/library/n8n-alternatives/index.mdx b/apps/sim/content/library/n8n-alternatives/index.mdx
index 03384814a46..567e4675f7a 100644
--- a/apps/sim/content/library/n8n-alternatives/index.mdx
+++ b/apps/sim/content/library/n8n-alternatives/index.mdx
@@ -3,10 +3,10 @@ slug: n8n-alternatives
 title: '10 Best n8n Alternatives for AI Agent Workflows in 2026'
 description: 'Comparing the 10 best n8n alternatives in 2026 for AI agent workflows - covering Sim, Make, Zapier, Activepieces, Pipedream, and more, with pricing and use cases.'
 date: 2026-07-13
-updated: 2026-09-08
+updated: 2026-09-17
 authors:
   - andrew
-readingTime: 17
+readingTime: 22
 tags: [n8n Alternatives, Workflow Automation, AI Agents, Sim]
 ogImage: /library/n8n-alternatives/cover.jpg
 canonical: https://www.sim.ai/library/n8n-alternatives
@@ -22,10 +22,50 @@ faq:
     a: "An open-source n8n alternative lets you inspect, modify, and self-host code under an open-source license. Sim supports self-hosted AI agent workflows, while Activepieces provides an MIT-licensed Community Edition. Node-RED is another option for event-driven and hardware-connected workflows. Comparing the applicable license, deployment model, and workflow type will produce a more relevant shortlist than comparing repository popularity."
   - q: "How hard is it to migrate from n8n to another tool?"
     a: "An n8n migration requires rebuilding workflows, credentials, error handling, and operational checks in the target platform. Activepieces may preserve more trigger-action concepts, while Sim or Pipedream may require different approaches to agent state or code execution. Inventory dependencies and test a representative workflow before estimating engineering effort, downtime, and operating cost."
+  - q: "What is an AI agent workflow builder?"
+    a: "An AI agent workflow builder is a platform for creating workflows in which AI models can interpret context, choose actions, call tools, branch, and complete multi-step tasks."
+  - q: "Is n8n an AI agent workflow builder?"
+    a: "n8n is an AI agent workflow builder when its AI capabilities, integrations, logic, and code steps are used to create tool-using, multi-step agent workflows."
+  - q: "Can n8n build AI agents?"
+    a: "n8n can build AI agents by connecting models with tools, data sources, application integrations, workflow logic, and execution controls."
+  - q: "What is the best n8n alternative for AI agent workflows?"
+    a: "Sim is a leading n8n alternative for AI agent workflows when a team prioritizes an agent-focused builder, Apache 2.0 licensing, and self-hosting."
+  - q: "What is the best open source n8n alternative?"
+    a: "Sim is the strongest open-source n8n alternative for teams that want an AI agent workflow builder under the OSI-approved Apache License 2.0."
+  - q: "What is the best open source AI workflow builder?"
+    a: "Sim is a strong choice for the best open source AI workflow builder when Apache 2.0 licensing, self-hosting, and agent-centered workflow design are primary requirements."
+  - q: "Is n8n open source?"
+    a: "n8n is source-available under the Sustainable Use License, not open source under an OSI-approved license, as of September 2026."
+  - q: "Is Sim open source?"
+    a: "Sim's open-source core is released under the OSI-approved Apache License 2.0, while the Enterprise Edition is governed by a separate license, as of September 2026."
+  - q: "What is the difference between open-source and source-available AI workflow builders?"
+    a: "Sim illustrates open-source software through its Apache 2.0 license, while n8n illustrates source-available software because its Sustainable Use License provides source access but imposes restrictions beyond OSI-approved open-source licenses."
+  - q: "Can I self-host Sim?"
+    a: "Sim can be self-hosted under the terms of its Apache License 2.0, as of September 2026."
+  - q: "Can I self-host n8n?"
+    a: "n8n can be self-hosted for uses allowed by its Sustainable Use License, as of September 2026."
+  - q: "Can I use n8n commercially?"
+    a: "n8n permits internal business use and other uses described in its Sustainable Use License, but n8n restricts certain commercial offerings such as charging customers for hosted access to n8n, as of September 2026."
+  - q: "Does n8n use the Apache 2.0 license?"
+    a: "n8n does not use Apache 2.0 and instead distributes its source under the Sustainable Use License, as of September 2026."
+  - q: "Is Sim free?"
+    a: "Sim's Apache 2.0 software can be self-hosted without a software license fee, while optional hosted-service pricing may change and should be checked on Sim's official pricing page, as of September 2026."
+  - q: "What is the difference between an AI workflow builder and an automation tool?"
+    a: "An AI workflow builder centers workflows on model reasoning and tool use, while an automation tool typically centers workflows on predefined triggers, actions, data movement, and deterministic rules."
+  - q: "Is Sim better than n8n?"
+    a: "Sim is better than n8n for teams prioritizing an Apache 2.0 AI agent workflow builder, while n8n can be better for teams prioritizing broad general-purpose workflow automation."
+  - q: "Sim vs n8n: which one should I choose?"
+    a: "Sim is the better choice for open-source AI agent workflow development, while n8n is the better choice when broad business-process automation is the dominant requirement."
+  - q: "What is the best AI agent builder?"
+    a: "Sim is a leading AI agent builder, but the full head-term evaluation belongs on Sim's canonical Best AI Agent Builders in 2026 comparison rather than on this n8n alternatives page."
+  - q: "What should I test before replacing n8n?"
+    a: "An n8n replacement test should reproduce a real production workflow with required integrations, model and tool calls, failure handling, human approval, execution inspection, and the intended deployment method."
 ---
 
 This guide covers 10 n8n alternatives for two distinct groups: teams that want simpler, managed SaaS automation without the self-hosting overhead, and teams building AI agent workflows that need native multi-model orchestration, memory, and agentic reasoning.
 
+n8n alternatives now need to be evaluated as AI agent workflow builders, not only as general-purpose automation tools. Buyers comparing platforms for agentic workflows should examine model access, tool calling, branching, memory and state handling, human approval steps, observability, deployment options, and licensing alongside conventional app integrations.
+
 ## [TL;DR](#tldr)
 
 - **n8n's core friction points in 2026:**  
@@ -67,6 +107,64 @@ n8n remains a strong fit for small developer teams running internal scripts at l
 
 Evaluate each alternative based on the capabilities your workflow requires, including persistent memory, multi-agent coordination, and MCP support. Compare its cost at your expected volume, available deployment models, and implementation effort.
 
+## Is n8n an AI agent workflow builder?
+
+[n8n is an AI agent workflow builder](https://docs.n8n.io/integrations/builtin/cluster-nodes/root-nodes/n8n-nodes-langchain.agent/tools-agent/) when teams use its AI nodes, integrations, branching, and code steps to create workflows in which models select or invoke tools. n8n remains a major incumbent for this use case because it combines AI functionality with a broad workflow-automation model.
+
+An AI agent workflow typically involves more than sending one prompt to a model. It can retrieve context, call external tools, update business systems, branch based on model output, pause for human review, and retain state across steps. The strongest n8n alternative therefore depends on how much a team values agent-focused building, conventional automation breadth, open-source licensing, self-hosting, or managed operations.
+
+## What should you look for in an n8n alternative for AI agent workflows?
+
+An n8n alternative for AI agent workflows should make agent behavior, tool use, execution state, deployment, and operating costs understandable before production use.
+
+Evaluate each platform using these criteria:
+
+- Agent workflow design: Can the platform represent model calls, tool calls, loops, branching, memory, and multi-step decisions clearly?
+- Model choice: Can the workflow use the model providers and model versions the team requires?
+- Tool connectivity: Can agents call APIs, databases, internal services, and business applications?
+- Human oversight: Can a workflow pause for approval, correction, or escalation?
+- Observability: Can operators inspect inputs, outputs, tool calls, errors, and execution history?
+- Deployment: Can the platform run in the vendor cloud, in the team's own environment, or both?
+- Licensing: Is the self-hosted software OSI-approved open source, source-available, or proprietary?
+- Billing unit: Does the hosted service meter credits, executions, tasks, steps, compute, or another unit?
+
+The existing comparison table and product profiles remain the source for platform-specific feature and pricing details, with changing claims linked to each vendor's current documentation.
+
+## Is n8n an open source AI workflow builder?
+
+n8n is source-available under the Sustainable Use License rather than open source under an OSI-approved license. As of September 2026, n8n permits uses described in its license documentation, including internal business purposes, but restricts certain commercial uses such as offering hosted n8n access as a paid service; teams should review the [official n8n license documentation](https://docs.n8n.io/privacy-and-security/sustainable-use-license) for the controlling terms.
+
+Sim is open-source software under the [OSI-approved](https://opensource.org/licenses) Apache License 2.0. As of September 2026, Sim's license permits use, modification, distribution, and self-hosting subject to the license terms, which can be reviewed in the [Sim repository](https://github.com/simstudioai/sim/blob/main/LICENSE).
+
+This distinction matters when a buyer asks for an open source AI workflow builder. Publicly viewable source code does not by itself make a product open source: the software license determines the rights users receive.
+
+## What is the best open source n8n alternative for AI agent workflows?
+
+Sim is the strongest n8n alternative for teams that specifically prioritize an [OSI-approved open-source license](https://opensource.org/licenses) and an interface centered on AI agent workflows. Sim uses [Apache 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE) and [supports self-hosting](https://docs.sim.ai/platform/self-hosting), while n8n uses the source-available [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license) and offers a broader general automation approach.
+
+This recommendation is intentionally narrower than the question of which platform is the best AI agent builder overall. Buyers researching that broader category should use the canonical Best AI Agent Builders in 2026 comparison linked near the conclusion.
+
+## Sim vs n8n: which is better for AI agent workflows?
+
+Sim is better suited to teams prioritizing open-source agent workflow development, while n8n is better suited to teams prioritizing a mature general-purpose automation platform with AI capabilities.
+
+| Decision factor | Sim | n8n |
+|---|---|---|
+| Primary framing | AI agent workflow builder | General workflow automation platform with AI capabilities |
+| Software license | [Apache License 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE), an [OSI-approved](https://opensource.org/licenses) open-source license | [Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license), a source-available license that is not OSI-approved |
+| Self-hosting | [Available under Apache 2.0](https://docs.sim.ai/platform/self-hosting) | [Available subject to the Sustainable Use License](https://docs.n8n.io/deploy/host-n8n/) |
+| Strongest fit | Teams building and operating AI agent workflows with open-source flexibility | Teams combining AI steps with broad business-process automation |
+| Main licensing consideration | Standard Apache 2.0 conditions apply | Certain commercial hosting and resale uses are restricted |
+
+As of September 2026, the license statements in this table are supported by the vendors' official license materials. Hosted pricing and plan-limit rows in the existing article retain their primary citations.
+
+## What are the key facts about Sim and n8n?
+
+Sim and n8n differ most clearly in product emphasis, software licensing, and hosted billing units.
+
+- Sim is an AI agent workflow builder that can be [self-hosted](https://docs.sim.ai/platform/self-hosting) under the [Apache License 2.0](https://github.com/simstudioai/sim/blob/main/LICENSE); [Sim's hosted plans](https://www.sim.ai/pricing) meter credits.
+- n8n is a workflow automation platform with [AI agent capabilities](https://docs.n8n.io/integrations/builtin/cluster-nodes/root-nodes/n8n-nodes-langchain.agent/tools-agent/) that can be [self-hosted under the Sustainable Use License](https://docs.n8n.io/privacy-and-security/sustainable-use-license); [n8n's hosted pricing](https://n8n.io/pricing/) is based on monthly workflow executions, with separate AI credit allowances listed by plan.
+
 ## [How to Choose an n8n Alternative](#how-to-choose-an-n8n-alternative)
 
 Choose a platform based first on your workflow type and preferred hosting model. Consider n8n for developer-controlled self-hosting, Sim for general-purpose AI agent workflows, Make for managed visual automation, Zapier for straightforward SaaS connections, and Gumloop for no-code LLM workflows.
@@ -109,6 +207,14 @@ The table below compares each tool by its primary use case, hosting model, and A
 | **[Microsoft Power Automate](https://www.microsoft.com/en-us/power-platform/products/power-automate/pricing)** | Microsoft automation platform with cloud and desktop flows | Organizations standardized on Microsoft 365 and Azure | Managed platform | AI Builder available at added cost |
 | **[Workato](https://docs.workato.com/en/pricing)** | Enterprise integration platform with governance and contractual support | Large organizations with compliance and SLA requirements | Managed platform | Enterprise orchestration |
 
+## How should you choose between n8n and an AI-focused workflow builder?
+
+n8n is the better starting point when broad business automation is the primary requirement, while an AI-focused workflow builder such as Sim is the better starting point when agent behavior is the center of the system.
+
+Choose based on the dominant workload rather than on the presence of an AI label. A workflow that mainly moves data among SaaS applications but includes one model call has different requirements from an agent that repeatedly chooses tools, evaluates intermediate results, requests approval, and adapts its next action.
+
+Teams should prototype a representative production workflow before deciding. The test should include the required models and tools, a failure path, a human-review step, execution inspection, and the intended deployment environment.
+
 ## [The 10 Best n8n Alternatives in 2026](#the-10-best-n8n-alternatives-in-2026)
 
 ### [Sim](#sim)
@@ -228,7 +334,7 @@ Activepieces is an n8n alternative for readers who prioritize permissive licensi
           The code-first approach means non-technical teammates can't build or modify workflows independently. Pipedream uses a step-based visual workflow interface rather than a free-form canvas, and it does not center the product on native AI agent orchestration.
 
 **Pricing:**
-          Free tier available with generous compute allowance. Paid plans scale with compute and execution volume. Check [Pipedream's pricing page](https://pipedream.com/pricing) for current rates.
+          [Pipedream's pricing page](https://pipedream.com/pricing) lists a free tier and paid plans metered in credits. Confirm the current credit allowances and plan features before choosing a plan.
 
 ### [Gumloop](#gumloop)
 
@@ -317,7 +423,7 @@ Microsoft Power Automate offers first-party connections to SharePoint, Teams, Ou
           It's a poor fit for teams outside the Microsoft ecosystem. AI Builder features add cost on top of base licensing. Simple automations may require more configuration than they do in narrower trigger-action tools. Licensing can also involve per-user, per-flow, and add-on charges, so confirm the required licenses for your deployment.
 
 **Pricing:**
-          Included with some Microsoft 365 plans. Standalone plans are available. Verify current pricing on [Microsoft's Power Automate page](https://www.microsoft.com/en-us/power-platform/products/power-automate/pricing).
+          Microsoft offers a free trial and standalone Power Automate plans. Verify current per-user and per-bot pricing on [Microsoft's Power Automate pricing page](https://www.microsoft.com/en-us/power-platform/products/power-automate/pricing).
 
 ### [Workato](#workato)
 
@@ -339,7 +445,7 @@ Workato is a managed enterprise integration platform for deployments that requir
           Priced for enterprise budgets. Workato is not suited for smaller teams or cost-sensitive deployments. Workato is proprietary, so migration may require rebuilding recipes, connections, and governance controls in another platform. Assess data portability and contract terms before deployment.
 
 **Pricing:**
-          Enterprise custom pricing, not published publicly. Review [Workato's pricing model](https://docs.workato.com/en/pricing), request a quote, and confirm contract minimums directly with Workato because the company does not publish standard rates.
+          [Workato's pricing documentation](https://docs.workato.com/en/pricing) describes a usage-based model with platform edition and usage fees for direct customers. Workato also documents credit-based Free and Pro self-service plans; confirm which model and allowances apply to your account.
 
 ## [How Open-Source Licenses Affect n8n Alternatives](#how-open-source-licenses-affect-n8n-alternatives)
 
@@ -362,6 +468,14 @@ Sim provides deployment options through Docker Compose and Kubernetes. Review Si
 **Self-hosted isn't automatically cheaper.**
           Before assuming that self-hosting eliminates automation costs, build a detailed estimate for total cost of ownership. Include server provisioning, database hosting, TLS certificates, security patches, version upgrades, monitoring, and maintenance time. A managed alternative may cost less when its subscription replaces enough infrastructure and engineering work.
 
+## Where can you compare other AI agent and workflow builders?
+
+Sim routes broad AI agent builder research to its canonical comparison and keeps this page focused on n8n alternatives.
+
+- For the broad head-term comparison, read [The Best AI Agent Builders in 2026](https://www.sim.ai/library/best-ai-agent-builder-2026).
+- For n8n replacement decisions, continue with the product profiles and comparison table on this page.
+- For open-source evaluation, compare the exact licenses and self-hosting rights rather than treating source-available and open-source software as equivalent.
+
 ## [The Bottom Line](#the-bottom-line)
 
 Choose an n8n alternative based on the workflow type and operating model you need.
diff --git a/apps/sim/ee/organization-usage/constants.ts b/apps/sim/ee/organization-usage/constants.ts
index 9f2e08e3c7d..4c717d6b4ae 100644
--- a/apps/sim/ee/organization-usage/constants.ts
+++ b/apps/sim/ee/organization-usage/constants.ts
@@ -91,5 +91,5 @@ export const USAGE_TAB_EMPTY_COPY: Record<UsageBreakdownDimension, string> = {
 export const COLLAPSED_ROW_COUNT = ORGANIZATION_USAGE_BREAKDOWN_DEFAULT_LIMIT
 export const EXPANDED_ROW_COUNT = ORGANIZATION_USAGE_BREAKDOWN_MAX_LIMIT
 
-export const DEFAULT_USAGE_PRESET = 'current-period' as const
+export const DEFAULT_USAGE_PRESET = '30d' as const
 export const DEFAULT_USAGE_TAB = USAGE_OVERVIEW_TAB
diff --git a/apps/sim/lib/copilot/generated/docs-manifest.ts b/apps/sim/lib/copilot/generated/docs-manifest.ts
index 7a1c35fc2a2..a9c8fc6b419 100644
--- a/apps/sim/lib/copilot/generated/docs-manifest.ts
+++ b/apps/sim/lib/copilot/generated/docs-manifest.ts
@@ -418,6 +418,7 @@ export const DOCS_MANIFEST: readonly string[] = [
   'platform/workspaces.mdx',
   'quick-reference.mdx',
   'search.mdx',
+  'search/coda.mdx',
   'search/confluence.mdx',
   'search/connect-your-account.mdx',
   'search/github.mdx',
diff --git a/apps/sim/lib/integrations/credential-display.test.ts b/apps/sim/lib/integrations/credential-display.test.ts
index 69dbcfff521..60c7ae3e5b8 100644
--- a/apps/sim/lib/integrations/credential-display.test.ts
+++ b/apps/sim/lib/integrations/credential-display.test.ts
@@ -49,7 +49,7 @@ const EXPECTED_COVERAGE: Record<string, string[]> = {
   'calcom-service-account': ['cal-com'],
   'claude-platform-service-account': [],
   'clickup-service-account': ['clickup'],
-  'coda-service-account': [],
+  'coda-service-account': ['coda'],
   'github-app-installation': ['github'],
   'google-service-account': [
     'gmail',
diff --git a/apps/sim/lib/integrations/credential-visibility.server.test.ts b/apps/sim/lib/integrations/credential-visibility.server.test.ts
index 30f9e271bed..7dee212ccc5 100644
--- a/apps/sim/lib/integrations/credential-visibility.server.test.ts
+++ b/apps/sim/lib/integrations/credential-visibility.server.test.ts
@@ -17,6 +17,7 @@ vi.mock('@/lib/integrations/availability.server', () => ({
   isOAuthServiceDeploymentAvailable: vi.fn(() => true),
 }))
 
+import { resolveIntegrationAvailability } from '@/lib/integrations/availability'
 import { createIntegrationCredentialVisibility } from '@/lib/integrations/credential-visibility.server'
 
 const SERVICES: readonly OAuthServiceMetadata[] = [
@@ -71,6 +72,41 @@ describe('integration credential visibility', () => {
     ])
   })
 
+  it('exposes Coda token credentials without OAuth while honoring integration policy and visibility', () => {
+    const catalog = resolveIntegrationAvailability({})
+    expect(catalog.find((entry) => entry.type === 'coda')).toMatchObject({
+      state: 'ready',
+      oauthAvailable: false,
+      serviceAccountAvailable: true,
+    })
+    getIntegrationAvailabilityMock.mockReturnValue(catalog)
+    const service: OAuthServiceMetadata = {
+      serviceId: 'coda',
+      providerId: 'coda',
+      serviceAccountProviderId: 'coda-service-account',
+      authType: 'service_account',
+      name: 'Coda',
+      description: 'Coda token',
+      baseProvider: 'coda',
+    }
+    const identity = { providerId: 'coda-service-account', type: 'service_account' } as const
+    const visibility = (allowed: ReadonlySet<string> | null, disabled: boolean) =>
+      createIntegrationCredentialVisibility({
+        allowedIntegrationTypes: allowed,
+        oauthServices: [service],
+        blockVisibility: {
+          revealed: new Set(),
+          previewTagged: new Set(),
+          disabled: new Set(disabled ? ['coda'] : []),
+        },
+      })
+    expect(visibility(new Set(['coda']), false).isCredentialVisible(identity)).toBe(true)
+    expect(visibility(new Set(['slack_v2']), false).isCredentialVisible(identity)).toBe(false)
+    expect(visibility(null, true).isCredentialVisible(identity)).toBe(false)
+    getBlockMock.mockReturnValue({ type: 'coda', preview: true })
+    expect(visibility(null, false).isCredentialVisible(identity)).toBe(false)
+  })
+
   it('applies the integration allowlist to OAuth and service-account credentials', () => {
     const visibility = createIntegrationCredentialVisibility({
       allowedIntegrationTypes: new Set(['slack_v2']),
diff --git a/apps/sim/lib/knowledge/__integration__/coda-live-fixture.test.ts b/apps/sim/lib/knowledge/__integration__/coda-live-fixture.test.ts
new file mode 100644
index 00000000000..0df3c74c15b
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/coda-live-fixture.test.ts
@@ -0,0 +1,27 @@
+/** @vitest-environment node */
+import { describe, expect, it } from 'vitest'
+import { assertCodaLiveFixture } from '@/lib/knowledge/__integration__/coda-live-fixture'
+
+const marker = 'SimConnector-fixture'
+const source = { name: `Sim Coda connector verification ${marker}`, owner: 'Owner@example.com' }
+
+describe('Coda live fixture validation', () => {
+  it.each(['Owner@example.com', 'owner@example.com', ' OWNER@EXAMPLE.COM '])(
+    'rejects the owner as the second identity: %s',
+    (secondEmail) => {
+      expect(() => assertCodaLiveFixture(source, marker, secondEmail)).toThrow(
+        'Refusing to change sharing'
+      )
+    }
+  )
+
+  it('rejects a document outside the disposable fixture', () => {
+    expect(() =>
+      assertCodaLiveFixture({ ...source, name: 'Unrelated' }, marker, 'reader@example.com')
+    ).toThrow('Refusing to change sharing')
+  })
+
+  it('accepts the disposable document with a distinct second identity', () => {
+    expect(() => assertCodaLiveFixture(source, marker, 'reader@example.com')).not.toThrow()
+  })
+})
diff --git a/apps/sim/lib/knowledge/__integration__/coda-live-fixture.ts b/apps/sim/lib/knowledge/__integration__/coda-live-fixture.ts
new file mode 100644
index 00000000000..95a99c0bab1
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/coda-live-fixture.ts
@@ -0,0 +1,15 @@
+import { normalizeEmail } from '@sim/utils/string'
+
+/** Checks the disposable document and distinct identities before live sharing mutations. */
+export function assertCodaLiveFixture(
+  source: { name: string; owner: string },
+  marker: string,
+  secondEmail: string
+): void {
+  if (
+    source.name !== `Sim Coda connector verification ${marker}` ||
+    normalizeEmail(source.owner) === normalizeEmail(secondEmail)
+  ) {
+    throw new Error('Refusing to change sharing on a non-fixture document')
+  }
+}
diff --git a/apps/sim/lib/knowledge/__integration__/coda-live.integration.ts b/apps/sim/lib/knowledge/__integration__/coda-live.integration.ts
new file mode 100644
index 00000000000..7b2674547b9
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/coda-live.integration.ts
@@ -0,0 +1,381 @@
+/**
+ * Opt-in test of real Coda, credential resolution, admin setup, storage, indexing,
+ * and application authorization. Only embeddings are substituted. Run with
+ * CODA_CONNECTOR_LIVE_TOKEN_FILE and CODA_CONNECTOR_LIVE_FIXTURE_FILE produced by
+ * connectors/coda/coda.live.test.ts, plus CODA_CONNECTOR_LIVE_SECOND_EMAIL.
+ * Only the disposable fixture's sharing is changed; notifications are suppressed.
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+import type { Principal } from '@sim/auth/principal'
+import { db } from '@sim/db'
+import {
+  credential,
+  document,
+  knowledgeBase,
+  knowledgeConnector,
+  member,
+  organization,
+  session,
+  user,
+  workspace,
+} from '@sim/db/schema'
+import { sleep } from '@sim/utils/helpers'
+import { generateId } from '@sim/utils/id'
+import { serializeSignedCookie } from 'better-call'
+import { eq } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { z } from 'zod'
+
+const metrics = vi.hoisted(() => ({ embeddingCalls: 0 }))
+vi.mock('@/lib/embeddings', async () => ({
+  ...(await import('@/lib/embeddings/client')),
+  assertKnowledgeEmbeddingCapacity: async () => {},
+  embedKnowledge: async (texts: string[]) => {
+    metrics.embeddingCalls++
+    return {
+      embeddings: texts.map(() => [1, ...Array<number>(1535).fill(0)]),
+      totalTokens: texts.length,
+      billableTokens: 0,
+      isBYOK: true,
+      modelName: 'text-embedding-3-small',
+      pricingId: 'text-embedding-3-small',
+    }
+  },
+}))
+
+import {
+  resolveBillingAttribution,
+  resolveOrganizationBillingAttribution,
+} from '@/lib/billing/core/billing-attribution'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import { createOrganizationCredential } from '@/lib/credentials/application/organization-credentials'
+import { assertCodaLiveFixture } from '@/lib/knowledge/__integration__/coda-live-fixture'
+import { seedKnowledgeAclFixture } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { listKnowledgeChunks } from '@/lib/knowledge/application/chunks'
+import { createKnowledgeConnector } from '@/lib/knowledge/application/connectors'
+import { readKnowledgeDocument } from '@/lib/knowledge/application/documents'
+import { searchKnowledge } from '@/lib/knowledge/application/search'
+import { executeSync } from '@/lib/knowledge/connectors/sync-engine'
+import { deleteFile } from '@/lib/uploads/core/storage-service'
+import { codaJson } from '@/connectors/coda/client'
+import { readCodaDocAcl } from '@/connectors/coda/permissions'
+import { buildCodaUrl, codaDocPath, codaHeaders } from '@/tools/coda/utils'
+
+const tokenPath = process.env.CODA_CONNECTOR_LIVE_TOKEN_FILE
+const fixturePath = process.env.CODA_CONNECTOR_LIVE_FIXTURE_FILE
+const secondEmail = process.env.CODA_CONNECTOR_LIVE_SECOND_EMAIL
+const allowSharing = process.env.CODA_CONNECTOR_LIVE_ALLOW_SHARING !== 'false'
+const organizationScope = process.env.CODA_CONNECTOR_LIVE_SCOPE === 'organization'
+const uiFixturePath = process.env.CODA_CONNECTOR_LIVE_UI_FIXTURE_FILE
+const fixtureSchema = z.object({
+  docId: z.string(),
+  pageId: z.string(),
+  marker: z.string().startsWith('SimConnector-'),
+})
+const permissionListSchema = z.object({
+  items: z.array(
+    z.object({ id: z.string(), principal: z.object({ email: z.string().optional() }) })
+  ),
+  nextPageToken: z.string().optional(),
+})
+
+describe
+  .skipIf(!tokenPath || !fixturePath || !secondEmail)
+  .sequential('live Coda ingestion and source access', () => {
+    let ids: Awaited<ReturnType<typeof seedKnowledgeAclFixture>>
+    let connectorId: string
+    let documentId: string
+    let token: string
+    let fixture: z.infer<typeof fixtureSchema>
+    let fixtureValidated = false
+    let credentialId = generateId()
+    const principal = (userId: string): Principal => ({
+      kind: 'session',
+      userId,
+      sessionId: 'coda-live',
+    })
+
+    async function mutation(path: string, method: string, body?: unknown) {
+      const response = await fetch(buildCodaUrl(path), {
+        method,
+        redirect: 'error',
+        headers: codaHeaders(token, body !== undefined),
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      })
+      await response.body?.cancel()
+      if (!response.ok) throw new Error(`Coda fixture mutation failed (${response.status})`)
+    }
+
+    async function revokeShare() {
+      const path = codaDocPath(fixture.docId, 'acl', 'permissions')
+      const permissions = await codaJson(token, path, permissionListSchema)
+      if (permissions.nextPageToken) throw new Error('Disposable fixture has unexpected sharing')
+      for (const item of permissions.items) {
+        if (item.principal.email?.toLowerCase() === secondEmail!.toLowerCase()) {
+          await mutation(`${path}/${encodeURIComponent(item.id)}`, 'DELETE')
+        }
+      }
+    }
+
+    async function waitForAcl(shared: boolean) {
+      for (let attempt = 0; attempt < 30; attempt++) {
+        const acl = await readCodaDocAcl(token, fixture.docId)
+        if (acl.includes(`u:${secondEmail!.toLowerCase()}`) === shared) return
+        await sleep(1000)
+      }
+      throw new Error('Coda sharing did not converge')
+    }
+
+    async function search(as: Principal) {
+      const result = await searchKnowledge.execute({
+        principal: as,
+        input: {
+          ...(organizationScope
+            ? { organizationId: ids.organizationId }
+            : { workspaceId: ids.workspaceId }),
+          knowledgeBaseIds: [ids.knowledgeBaseId],
+          query: fixture.marker,
+          searchMode: 'hybrid',
+          topK: 10,
+        },
+      })
+      return result.results.map((row) => row.documentId)
+    }
+
+    async function sync() {
+      const result = await executeSync(connectorId, {
+        fullSync: false,
+        billingAttribution: organizationScope
+          ? await resolveOrganizationBillingAttribution({
+              actorUserId: ids.aliceId,
+              organizationId: ids.organizationId,
+            })
+          : await resolveBillingAttribution({
+              actorUserId: ids.aliceId,
+              workspaceId: ids.workspaceId,
+            }),
+      })
+      expect(result.error).toBeUndefined()
+      expect(result.skipReason).toBeUndefined()
+      expect(result.docsFailed).toBe(0)
+      return result
+    }
+
+    beforeAll(async () => {
+      token = readFileSync(tokenPath!, 'utf8').trim()
+      fixture = fixtureSchema.parse(JSON.parse(readFileSync(fixturePath!, 'utf8')))
+      const source = await codaJson(
+        token,
+        codaDocPath(fixture.docId),
+        z.object({ name: z.string(), owner: z.string().email() })
+      )
+      assertCodaLiveFixture(source, fixture.marker, secondEmail!)
+      fixtureValidated = true
+      await revokeShare()
+      await waitForAcl(false)
+      ids = await seedKnowledgeAclFixture()
+      await db.update(user).set({ email: source.owner }).where(eq(user.id, ids.aliceId))
+      await db.update(user).set({ email: secondEmail! }).where(eq(user.id, ids.bobId))
+      if (organizationScope) {
+        await db.insert(member).values([
+          {
+            id: generateId(),
+            organizationId: ids.organizationId,
+            userId: ids.aliceId,
+            role: 'owner',
+            createdAt: new Date(),
+          },
+          {
+            id: generateId(),
+            organizationId: ids.organizationId,
+            userId: ids.bobId,
+            role: 'member',
+            createdAt: new Date(),
+          },
+        ])
+        await db
+          .update(knowledgeBase)
+          .set({ workspaceId: null, organizationId: ids.organizationId, isSearchIndex: true })
+          .where(eq(knowledgeBase.id, ids.knowledgeBaseId))
+        const createdCredential = await createOrganizationCredential.execute({
+          principal: principal(ids.aliceId),
+          input: {
+            organizationId: ids.organizationId,
+            type: 'service_account',
+            providerId: 'coda-service-account',
+            displayName: 'Disposable Coda live fixture',
+            apiToken: token,
+          },
+        })
+        credentialId = createdCredential.credential.id
+      } else
+        await db.insert(credential).values({
+          id: credentialId,
+          workspaceId: ids.workspaceId,
+          createdBy: ids.aliceId,
+          type: 'service_account',
+          providerId: 'coda-service-account',
+          displayName: 'Disposable Coda live fixture',
+          encryptedServiceAccountKey: (
+            await encryptSecret(
+              JSON.stringify({
+                type: 'token_service_account',
+                providerId: 'coda-service-account',
+                apiToken: token,
+              })
+            )
+          ).encrypted,
+        })
+      const created = await createKnowledgeConnector.execute({
+        principal: principal(ids.aliceId),
+        input: {
+          knowledgeBaseId: ids.knowledgeBaseId,
+          ...(organizationScope
+            ? { assertedOrganizationId: ids.organizationId }
+            : { assertedWorkspaceId: ids.workspaceId }),
+          connectorType: 'coda',
+          credentialId,
+          accessMode: 'admin',
+          sourceConfig: { docIds: [fixture.docId] },
+          syncIntervalMinutes: 60,
+        },
+      })
+      connectorId = created.connector.id
+      for (let attempt = 0; attempt < 120; attempt++) {
+        const [source] = await db
+          .select()
+          .from(knowledgeConnector)
+          .where(eq(knowledgeConnector.id, connectorId))
+        if (source.status === 'error')
+          throw new Error(source.lastSyncError ?? 'Initial Coda sync failed')
+        if (source.lastSyncAt && source.status === 'active') break
+        await sleep(1000)
+      }
+      const stored = await db.select().from(document).where(eq(document.connectorId, connectorId))
+      expect(stored.length).toBeGreaterThanOrEqual(2)
+      expect(stored.every((row) => row.processingStatus === 'completed')).toBe(true)
+      documentId = stored.find(
+        (row) => row.externalId === `${fixture.docId}/pages/${fixture.pageId}`
+      )!.id
+    }, 180_000)
+
+    afterAll(async () => {
+      try {
+        if (fixtureValidated && allowSharing) {
+          await revokeShare()
+          await waitForAcl(false)
+        }
+      } finally {
+        if (ids && !uiFixturePath) {
+          const rows = await db
+            .select()
+            .from(document)
+            .where(eq(document.knowledgeBaseId, ids.knowledgeBaseId))
+          for (const row of rows)
+            if (row.storageKey) await deleteFile({ key: row.storageKey, context: 'knowledge-base' })
+          await db.delete(workspace).where(eq(workspace.id, ids.workspaceId))
+          await db.delete(organization).where(eq(organization.id, ids.organizationId))
+          await db.delete(user).where(eq(user.id, ids.aliceId))
+          await db.delete(user).where(eq(user.id, ids.bobId))
+        }
+        if (ids && uiFixturePath) {
+          const sessionToken = generateId()
+          await db.insert(session).values({
+            id: generateId(),
+            token: sessionToken,
+            userId: ids.aliceId,
+            expiresAt: new Date(Date.now() + 3_600_000),
+            createdAt: new Date(),
+            updatedAt: new Date(),
+          })
+          const cookie = await serializeSignedCookie(
+            'better-auth.session_token',
+            sessionToken,
+            process.env.BETTER_AUTH_SECRET!
+          )
+          writeFileSync(
+            uiFixturePath,
+            JSON.stringify({ ...ids, connectorId, cookie, databaseUrl: process.env.DATABASE_URL }),
+            { mode: 0o600 }
+          )
+        }
+        await db.$client.end()
+      }
+    }, 60_000)
+
+    it('indexes through admin setup and restricts private content to its owner', async () => {
+      expect(metrics.embeddingCalls).toBeGreaterThan(0)
+      expect(await search(principal(ids.aliceId))).toContain(documentId)
+      expect(await search(principal(ids.bobId))).not.toContain(documentId)
+      const keySearch = search({
+        kind: 'workspace_api_key',
+        workspaceId: ids.workspaceId,
+        keyId: 'fixture',
+      })
+      if (organizationScope) await expect(keySearch).rejects.toThrow()
+      else expect(await keySearch).not.toContain(documentId)
+      const chunks = await listKnowledgeChunks.execute({
+        principal: principal(ids.aliceId),
+        input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+      })
+      expect(chunks.chunks.map((row) => row.content).join('\n')).toContain(
+        `${fixture.marker} updated content`
+      )
+    })
+
+    it('does not re-embed unchanged pages or tables during a permission refresh', async () => {
+      const before = metrics.embeddingCalls
+      const result = await sync()
+      expect(result.docsUnchanged).toBeGreaterThanOrEqual(2)
+      expect(metrics.embeddingCalls).toBe(before)
+      expect(await search(principal(ids.aliceId))).toContain(documentId)
+      expect(await search(principal(ids.bobId))).not.toContain(documentId)
+    })
+
+    it.skipIf(!allowSharing)(
+      'propagates a real Coda email share to search and document reads',
+      async () => {
+        await mutation(codaDocPath(fixture.docId, 'acl', 'permissions'), 'POST', {
+          access: 'readonly',
+          principal: { type: 'email', email: secondEmail },
+          suppressEmail: true,
+        })
+        await waitForAcl(true)
+        await sync()
+        expect(await search(principal(ids.bobId))).toContain(documentId)
+        const result = await readKnowledgeDocument.execute({
+          principal: principal(ids.bobId),
+          input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+        })
+        expect(result.document.id).toBe(documentId)
+      },
+      120_000
+    )
+
+    it('denies an unverified Sim email even for the Coda document owner', async () => {
+      await db.update(user).set({ emailVerified: false }).where(eq(user.id, ids.aliceId))
+      try {
+        expect(await search(principal(ids.aliceId))).not.toContain(documentId)
+      } finally {
+        await db.update(user).set({ emailVerified: true }).where(eq(user.id, ids.aliceId))
+      }
+    })
+
+    it.skipIf(!allowSharing)(
+      'removes search and read access after source sharing is revoked without editing content',
+      async () => {
+        await revokeShare()
+        await waitForAcl(false)
+        await sync()
+        expect(await search(principal(ids.bobId))).not.toContain(documentId)
+        await expect(
+          readKnowledgeDocument.execute({
+            principal: principal(ids.bobId),
+            input: { knowledgeBaseId: ids.knowledgeBaseId, documentId },
+          })
+        ).rejects.toThrow()
+        expect(await search(principal(ids.aliceId))).toContain(documentId)
+      },
+      120_000
+    )
+  })
diff --git a/apps/sim/lib/knowledge/__integration__/embedding-insert-batches.integration.ts b/apps/sim/lib/knowledge/__integration__/embedding-insert-batches.integration.ts
new file mode 100644
index 00000000000..0761840834d
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/embedding-insert-batches.integration.ts
@@ -0,0 +1,191 @@
+/** Real transaction rollback across embedding, search projections, provenance, and completion state. */
+import { mkdtempSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { db } from '@sim/db'
+import {
+  document,
+  embedding,
+  embeddingSecretProvenance,
+  knowledgeBase,
+  organization,
+  user,
+  workspace,
+} from '@sim/db/schema'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+const fixtures = vi.hoisted(() => ({ root: '', process: vi.fn(), embeddings: vi.fn() }))
+vi.mock('@/lib/uploads/core/setup.server', () => ({
+  get UPLOAD_DIR_SERVER() {
+    return fixtures.root
+  },
+}))
+vi.mock('@/lib/knowledge/documents/document-processor', () => ({
+  processDocument: fixtures.process,
+}))
+vi.mock('@/lib/knowledge/embeddings', () => ({ generateEmbeddings: fixtures.embeddings }))
+
+import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
+import * as embeddingClient from '@/lib/embeddings/client'
+import {
+  createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import { createContentSyncLease } from '@/lib/knowledge/connectors/sync-lock'
+import { addDocument } from '@/lib/knowledge/connectors/sync-persistence'
+import { processDocumentAsync } from '@/lib/knowledge/documents/service'
+import {
+  createKnowledgeDocumentSourceValue,
+  replaceKnowledgeDocumentSecretProvenanceInTx,
+} from '@/lib/knowledge/secret-provenance'
+
+describe('bounded embedding insert transactions', () => {
+  const ids = createKnowledgeAclFixtureIds()
+  const triggerName = `fixture_embedding_batch_${generateId().replaceAll('-', '')}`
+
+  beforeAll(async () => {
+    fixtures.root = mkdtempSync(path.join(tmpdir(), 'sim-embedding-batches-'))
+    await seedKnowledgeAclFixture(ids, { connectorType: 'google_drive' })
+    vi.spyOn(embeddingClient, 'assertKnowledgeEmbeddingCapacity').mockResolvedValue(undefined)
+  })
+
+  afterAll(async () => {
+    vi.restoreAllMocks()
+    await db.$client.unsafe(`DROP TRIGGER IF EXISTS ${triggerName} ON embedding`)
+    await db.$client.unsafe(`DROP FUNCTION IF EXISTS ${triggerName}()`)
+    await db.delete(knowledgeBase).where(eq(knowledgeBase.id, ids.knowledgeBaseId))
+    await db.delete(workspace).where(eq(workspace.id, ids.workspaceId))
+    await db.delete(organization).where(eq(organization.id, ids.organizationId))
+    await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+    await rm(fixtures.root, { recursive: true, force: true })
+    await db.$client.end()
+  })
+
+  it('rolls back a second-batch failure and replaces the complete index on retry', async () => {
+    const file = await addDocument(
+      ids.knowledgeBaseId,
+      ids.connectorId,
+      'google_drive',
+      {
+        externalId: 'atomic-batch-fixture',
+        title: 'Synthetic batch fixture.txt',
+        content: 'Synthetic replacement text',
+        mimeType: 'text/plain',
+        contentHash: 'synthetic-replacement',
+      },
+      { userId: ids.aliceId, workspaceId: ids.workspaceId },
+      undefined,
+      'workspace',
+      createContentSyncLease(ids.connectorId, ids.lockId)
+    )
+    const [source] = await db.select().from(document).where(eq(document.id, file.documentId))
+    await db.transaction((tx) =>
+      replaceKnowledgeDocumentSecretProvenanceInTx(
+        tx,
+        file.documentId,
+        createKnowledgeDocumentSourceValue(source),
+        { status: 'exact', entries: [] }
+      )
+    )
+    const previousId = generateId()
+    await db.insert(embedding).values({
+      id: previousId,
+      knowledgeBaseId: ids.knowledgeBaseId,
+      documentId: file.documentId,
+      chunkIndex: 0,
+      chunkHash: 'previous-hash',
+      content: 'Previously indexed text',
+      contentLength: 23,
+      tokenCount: 5,
+      startOffset: 0,
+      endOffset: 23,
+      embedding: Array(1536).fill(0.1),
+      secretProvenanceVersion: 1,
+    })
+    await db.insert(embeddingSecretProvenance).values({
+      embeddingId: previousId,
+      contentHash: 'previous-hash',
+      status: 'exact',
+      entries: [],
+    })
+    await db.update(document).set({ chunkCount: 1 }).where(eq(document.id, file.documentId))
+
+    const chunks = Array.from({ length: 205 }, (_, index) => ({
+      text: `Synthetic chunk ${index}`,
+      metadata: { startIndex: index * 20, endIndex: index * 20 + 19 },
+    }))
+    fixtures.process.mockResolvedValue({
+      chunks,
+      metadata: { chunkCount: chunks.length, tokenCount: 615, characterCount: 4100 },
+    })
+    fixtures.embeddings.mockResolvedValue({
+      embeddings: chunks.map(() => Array(1536).fill(0.2)),
+      billableTokens: 0,
+      modelName: 'text-embedding-3-small',
+      pricingId: 'text-embedding-3-small',
+    })
+    const billing = await resolveBillingAttribution({
+      actorUserId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+    })
+    await db.$client.unsafe(`CREATE FUNCTION ${triggerName}() RETURNS trigger LANGUAGE plpgsql AS $$
+      BEGIN
+        IF NEW.document_id = '${file.documentId}' AND NEW.chunk_index >= 100 THEN
+          RAISE EXCEPTION 'Synthetic second-batch failure' USING ERRCODE = '57014';
+        END IF;
+        RETURN NEW;
+      END;
+      $$`)
+    await db.$client.unsafe(`CREATE TRIGGER ${triggerName} BEFORE INSERT ON embedding
+      FOR EACH ROW EXECUTE FUNCTION ${triggerName}()`)
+
+    await expect(
+      processDocumentAsync(ids.knowledgeBaseId, file.documentId, file, {}, billing)
+    ).rejects.toMatchObject({ cause: { code: '57014' } })
+    expect(
+      await db
+        .select({ id: embedding.id })
+        .from(embedding)
+        .where(eq(embedding.documentId, file.documentId))
+    ).toEqual([{ id: previousId }])
+    for (const table of ['embedding_search', 'embedding_keyword_search']) {
+      expect(
+        await db.$client.unsafe(`SELECT id FROM ${table} WHERE document_id = $1`, [file.documentId])
+      ).toEqual([{ id: previousId }])
+    }
+    expect(
+      await db
+        .select()
+        .from(embeddingSecretProvenance)
+        .where(eq(embeddingSecretProvenance.embeddingId, previousId))
+    ).toMatchObject([{ contentHash: 'previous-hash', status: 'exact' }])
+    expect(await db.select().from(document).where(eq(document.id, file.documentId))).toMatchObject([
+      {
+        processingStatus: 'failed',
+        chunkCount: 1,
+        processingError: 'Database request failed (SQLSTATE 57014).',
+      },
+    ])
+
+    await db.$client.unsafe(`DROP TRIGGER ${triggerName} ON embedding`)
+    await processDocumentAsync(ids.knowledgeBaseId, file.documentId, file, {}, billing)
+    expect(await db.select().from(document).where(eq(document.id, file.documentId))).toMatchObject([
+      { processingStatus: 'completed', chunkCount: 205, processingError: null },
+    ])
+    for (const table of ['embedding', 'embedding_search', 'embedding_keyword_search']) {
+      expect(
+        await db.$client.unsafe(
+          `SELECT count(*)::int AS count FROM ${table} WHERE document_id = $1`,
+          [file.documentId]
+        )
+      ).toEqual([{ count: 205 }])
+    }
+    expect(
+      await db.$client`SELECT count(*)::int AS count FROM embedding_secret_provenance p
+      INNER JOIN embedding e ON e.id = p.embedding_id WHERE e.document_id = ${file.documentId}`
+    ).toEqual([{ count: 205 }])
+  })
+})
diff --git a/apps/sim/lib/knowledge/__integration__/member-document-lifecycle.integration.ts b/apps/sim/lib/knowledge/__integration__/member-document-lifecycle.integration.ts
new file mode 100644
index 00000000000..42e15503338
--- /dev/null
+++ b/apps/sim/lib/knowledge/__integration__/member-document-lifecycle.integration.ts
@@ -0,0 +1,184 @@
+/** Real PostgreSQL coverage for bounded lifecycle writes and changing observations. */
+import { db } from '@sim/db'
+import {
+  document,
+  knowledgeConnector,
+  knowledgeDocumentObservation,
+  organization,
+  user,
+  workspace,
+} from '@sim/db/schema'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray, sql } from 'drizzle-orm'
+import { afterAll, afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  type createKnowledgeAclFixtureIds,
+  seedKnowledgeAclFixture,
+  seedKnowledgeMemberFixture,
+} from '@/lib/knowledge/__integration__/seed-source-access-fixture'
+import {
+  applyMemberDocumentLifecycle,
+  recordMemberObservations,
+} from '@/lib/knowledge/connectors/member-observations'
+import {
+  assertSyncLeaseHeldInTx,
+  SyncLockLostException,
+  stillHoldsMemberSyncLock,
+} from '@/lib/knowledge/connectors/sync-lock'
+
+describe('member document lifecycle in PostgreSQL', () => {
+  let ids: ReturnType<typeof createKnowledgeAclFixtureIds>
+  let members: Awaited<ReturnType<typeof seedKnowledgeMemberFixture>>
+  const seenAt = sql`'2026-01-01 00:00:00.000123'::timestamp`
+  const deletedAt = new Date()
+
+  beforeEach(async () => {
+    ids = await seedKnowledgeAclFixture()
+    members = await seedKnowledgeMemberFixture(ids)
+  })
+
+  afterEach(async () => {
+    await db.delete(workspace).where(eq(workspace.id, ids.workspaceId))
+    await db.delete(organization).where(eq(organization.id, ids.organizationId))
+    await db.delete(user).where(inArray(user.id, [ids.aliceId, ids.bobId]))
+  })
+
+  afterAll(() => db.$client.end())
+
+  const row = (externalId: string) => ({
+    id: generateId(),
+    knowledgeBaseId: ids.knowledgeBaseId,
+    connectorId: members.connectorId,
+    externalId,
+    filename: externalId,
+    fileUrl: '',
+    fileSize: 0,
+    mimeType: 'text/plain',
+    processingStatus: 'completed',
+    contentHash: 'verified-content',
+    sourceSeenAt: seenAt,
+  })
+
+  const observe = (documentIds: string[]) =>
+    recordMemberObservations(db, members.members[0].id, documentIds, members.runId)
+
+  const run = (options: { beforeWrite?: () => Promise<void>; allowRemoval?: boolean } = {}) =>
+    applyMemberDocumentLifecycle({
+      connectorId: members.connectorId,
+      knowledgeBaseId: ids.knowledgeBaseId,
+      runId: members.runId,
+      allowRemoval: options.allowRemoval ?? true,
+      deadlineAt: Date.now() + 60_000,
+      lease: { beatIfDue: async () => {} },
+      withLease: async (fn) => {
+        await options.beforeWrite?.()
+        return db.transaction(async (tx) => {
+          await assertSyncLeaseHeldInTx(tx, members.connectorId, {
+            stillHeld: () => stillHoldsMemberSyncLock(members.connectorId, members.runId),
+          })
+          return fn(tx)
+        })
+      },
+    })
+
+  it('walks multiple batches across null and microsecond timestamps and preserves exclusions', async () => {
+    const stale = Array.from({ length: 1100 }, (_, index) => ({
+      ...row(String(index)),
+      sourceSeenAt: index < 550 ? null : seenAt,
+    }))
+    const observed = row('observed')
+    const excluded = { ...row('excluded'), userExcluded: true }
+    const archived = { ...row('archived'), archivedAt: new Date() }
+    const restore = { ...row('restore'), deletedAt }
+    const noContent = { ...row('no-content'), deletedAt, contentHash: null }
+    const rows = [...stale, observed, excluded, archived, restore, noContent]
+    for (let offset = 0; offset < rows.length; offset += 500)
+      await db.insert(document).values(rows.slice(offset, offset + 500))
+    await observe([observed.id, restore.id, noContent.id])
+
+    expect(await run()).toEqual({ tombstoned: 1100, resurrected: 1, purged: 0, finished: true })
+    const stored = await db
+      .select({ id: document.id, deletedAt: document.deletedAt })
+      .from(document)
+      .where(eq(document.connectorId, members.connectorId))
+    const byId = new Map(stored.map((entry) => [entry.id, entry.deletedAt]))
+    expect(stale.every((entry) => byId.get(entry.id) instanceof Date)).toBe(true)
+    for (const entry of [observed, excluded, archived, restore])
+      expect(byId.get(entry.id)).toBeNull()
+    expect(byId.get(noContent.id)).toEqual(deletedAt)
+  })
+
+  it('continues past a full selected batch even if its observations change before UPDATE', async () => {
+    const rows = Array.from({ length: 501 }, (_, index) => row(String(index)))
+    await db.insert(document).values(rows)
+    const selected = await db
+      .select({ id: document.id })
+      .from(document)
+      .where(eq(document.connectorId, members.connectorId))
+      .orderBy(document.id)
+      .limit(500)
+    let writes = 0
+    const result = await run({
+      beforeWrite: async () => {
+        if (writes++ === 0) await observe(selected.map(({ id }) => id))
+      },
+    })
+    expect(result).toEqual({ tombstoned: 1, resurrected: 0, purged: 0, finished: true })
+    const stored = await db
+      .select({ id: document.id, deletedAt: document.deletedAt })
+      .from(document)
+      .where(eq(document.connectorId, members.connectorId))
+    expect(stored.filter((entry) => entry.deletedAt !== null)).toHaveLength(1)
+    const observedIds = new Set(selected.map(({ id }) => id))
+    expect(stored.every((entry) => !observedIds.has(entry.id) || entry.deletedAt === null)).toBe(
+      true
+    )
+  })
+
+  it('does not resurrect a document whose last observation disappeared before UPDATE', async () => {
+    const target = { ...row('lost-observation'), deletedAt }
+    await db.insert(document).values(target)
+    await observe([target.id])
+    expect(
+      await run({
+        beforeWrite: async () => {
+          await db
+            .delete(knowledgeDocumentObservation)
+            .where(eq(knowledgeDocumentObservation.documentId, target.id))
+        },
+      })
+    ).toEqual({ tombstoned: 0, resurrected: 0, purged: 0, finished: true })
+    const [stored] = await db.select().from(document).where(eq(document.id, target.id))
+    expect(stored.deletedAt).toEqual(deletedAt)
+  })
+
+  it('leaves unobserved documents alone until a member completed a listing', async () => {
+    const target = row('not-yet-observed')
+    await db.insert(document).values(target)
+    expect(await run({ allowRemoval: false })).toEqual({
+      tombstoned: 0,
+      resurrected: 0,
+      purged: 0,
+      finished: true,
+    })
+    const [stored] = await db.select().from(document).where(eq(document.id, target.id))
+    expect(stored.deletedAt).toBeNull()
+  })
+
+  it('refuses the write when another run claimed the connector after selection', async () => {
+    const target = row('lost-lease')
+    await db.insert(document).values(target)
+    await expect(
+      run({
+        beforeWrite: async () => {
+          await db
+            .update(knowledgeConnector)
+            .set({ memberSyncLockToken: generateId() })
+            .where(eq(knowledgeConnector.id, members.connectorId))
+        },
+      })
+    ).rejects.toBeInstanceOf(SyncLockLostException)
+    const [stored] = await db.select().from(document).where(eq(document.id, target.id))
+    expect(stored.deletedAt).toBeNull()
+  })
+})
diff --git a/apps/sim/lib/knowledge/__integration__/organization-search-overview.integration.ts b/apps/sim/lib/knowledge/__integration__/organization-search-overview.integration.ts
index 1e16c3f52c4..f9565f1097e 100644
--- a/apps/sim/lib/knowledge/__integration__/organization-search-overview.integration.ts
+++ b/apps/sim/lib/knowledge/__integration__/organization-search-overview.integration.ts
@@ -15,7 +15,7 @@ import {
   workspace,
 } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
-import { eq, inArray } from 'drizzle-orm'
+import { eq, inArray, sql } from 'drizzle-orm'
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import {
   createKnowledgeAclFixtureIds,
@@ -23,6 +23,7 @@ import {
 } from '@/lib/knowledge/__integration__/seed-source-access-fixture'
 import { readOrganizationSearchOverview } from '@/lib/knowledge/application/organization-search-overview'
 import { listSearchSources } from '@/lib/knowledge/application/search-sources'
+import { SOURCE_PERMISSION_ERROR } from '@/lib/knowledge/connectors/sync-limits'
 
 const ids = createKnowledgeAclFixtureIds()
 const indexId = generateId()
@@ -177,6 +178,44 @@ async function provider(connectorType: string) {
 }
 
 describe('organization operational overview with real SQL', () => {
+  it.each([
+    SOURCE_PERMISSION_ERROR,
+    `Directory refresh incomplete: fixture\n${SOURCE_PERMISSION_ERROR}`,
+    `${SOURCE_PERMISSION_ERROR}\nSource listing failed for a fixture account`,
+    `Directory refresh incomplete: fixture\n${SOURCE_PERMISSION_ERROR}\nSource listing failed for a fixture account`,
+  ])(
+    'recognizes a complete permission notice within composed diagnostics: %s',
+    async (lastSyncError) => {
+      await db
+        .update(knowledgeConnector)
+        .set({ lastSyncError })
+        .where(eq(knowledgeConnector.id, driveId))
+      expect(await provider('google_drive')).toMatchObject({
+        status: 'needs_attention',
+        issue: 'permission_sync_incomplete',
+      })
+    }
+  )
+
+  it('does not classify a provider message containing the permission text as its own notice', async () => {
+    await db
+      .update(knowledgeConnector)
+      .set({ lastSyncError: `Provider message: ${SOURCE_PERMISSION_ERROR}` })
+      .where(eq(knowledgeConnector.id, driveId))
+    expect(await provider('google_drive')).toMatchObject({
+      status: 'needs_attention',
+      issue: 'sync_failed',
+    })
+  })
+
+  it('ignores permission notices on paused sources', async () => {
+    await db
+      .update(knowledgeConnector)
+      .set({ lastSyncError: `Directory refresh incomplete: fixture\n${SOURCE_PERMISSION_ERROR}` })
+      .where(eq(knowledgeConnector.id, pausedDriveId))
+    expect(await provider('google_drive')).toMatchObject({ status: 'active', issue: null })
+  })
+
   it('counts configured sources independently of viewer ACLs, and excludes workspace and untouched providers', async () => {
     const result = await readOrganizationSearchOverview.execute({ principal, input })
     expect(result.providers).toEqual(
@@ -188,6 +227,7 @@ describe('organization operational overview with real SQL', () => {
           status: 'active',
           issue: null,
           isSyncing: false,
+          hasPendingSync: false,
         },
         {
           connectorType: 'gmail',
@@ -196,6 +236,7 @@ describe('organization operational overview with real SQL', () => {
           status: 'active',
           issue: null,
           isSyncing: false,
+          hasPendingSync: false,
         },
       ])
     )
@@ -237,7 +278,7 @@ describe('organization operational overview with real SQL', () => {
       .where(eq(knowledgeConnector.id, gmailId))
     expect(await provider('gmail')).toMatchObject({ status: 'waiting_for_connections' })
   })
-  it('distinguishes normal member continuation from partial failure without treating idle as success', async () => {
+  it('distinguishes queued member continuation from active indexing and partial failure', async () => {
     await db
       .update(knowledgeConnectorMember)
       .set({ listingCheckpoint: { cursor: 'fixture' } })
@@ -248,9 +289,15 @@ describe('organization operational overview with real SQL', () => {
       connectorId: gmailId,
       status: 'partial',
       membersIncomplete: 1,
+      docsFailed: 0,
+      processingDispatchFailed: 0,
       completedAt: new Date(),
     })
-    expect(await provider('gmail')).toMatchObject({ status: 'indexing' })
+    expect(await provider('gmail')).toMatchObject({
+      status: 'active',
+      isSyncing: false,
+      hasPendingSync: true,
+    })
     await db
       .update(knowledgeConnectorMemberSyncLog)
       .set({ membersFailed: 1 })
@@ -267,9 +314,13 @@ describe('organization operational overview with real SQL', () => {
     expect(await provider('gmail')).toMatchObject({ status: 'needs_attention' })
     await db
       .update(knowledgeConnector)
-      .set({ nextMemberSyncAt: new Date() })
+      .set({ nextMemberSyncAt: sql`statement_timestamp() - interval '1 second'` })
       .where(eq(knowledgeConnector.id, gmailId))
-    expect(await provider('gmail')).toMatchObject({ status: 'indexing' })
+    expect(await provider('gmail')).toMatchObject({
+      status: 'active',
+      isSyncing: false,
+      hasPendingSync: true,
+    })
     await db
       .update(knowledgeConnector)
       .set({ nextMemberSyncAt: null })
@@ -278,6 +329,8 @@ describe('organization operational overview with real SQL', () => {
       id: generateId(),
       connectorId: gmailId,
       status: 'completed',
+      docsFailed: 0,
+      processingDispatchFailed: 0,
       startedAt: new Date(Date.now() + 1000),
       completedAt: new Date(),
     })
diff --git a/apps/sim/lib/knowledge/application/organization-search-overview.ts b/apps/sim/lib/knowledge/application/organization-search-overview.ts
index 890fc5c5cb2..085e0537462 100644
--- a/apps/sim/lib/knowledge/application/organization-search-overview.ts
+++ b/apps/sim/lib/knowledge/application/organization-search-overview.ts
@@ -213,7 +213,7 @@ export const readOrganizationSearchOverview = defineAuthorizedKnowledgeUseCase({
         ))`,
           hasAccountError: sql<boolean>`bool_or(NOT ${paused} AND ${knowledgeConnector.accessMode} = 'members' AND ${hasMemberError})`,
           hasDocumentError: sql<boolean>`bool_or(NOT ${paused} AND ${hasDocumentsInState(failedDocumentCondition())})`,
-          hasPermissionError: sql<boolean>`bool_or(NOT ${paused} AND ${knowledgeConnector.lastSyncError} = ${SOURCE_PERMISSION_ERROR})`,
+          hasPermissionError: sql<boolean>`bool_or(NOT ${paused} AND ${SOURCE_PERMISSION_ERROR} = ANY(string_to_array(${knowledgeConnector.lastSyncError}, ${'\n'})))`,
           hasIndexing: sql<boolean>`bool_or(NOT ${paused}
             AND (${knowledgeConnector.accessMode} <> 'members' OR ${hasActiveMembers} OR ${knowledgeConnector.credentialId} IS NOT NULL)
             AND (
diff --git a/apps/sim/lib/knowledge/connectors/external-group-sync.test.ts b/apps/sim/lib/knowledge/connectors/external-group-sync.test.ts
index 5369a251407..85ee6179525 100644
--- a/apps/sim/lib/knowledge/connectors/external-group-sync.test.ts
+++ b/apps/sim/lib/knowledge/connectors/external-group-sync.test.ts
@@ -5,6 +5,7 @@ import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@s
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { getConnectorFailureDiagnostic } from '@/lib/knowledge/connectors/connector-error'
 import { GoogleDriveApiError } from '@/connectors/google-drive/google-drive-errors'
+import { ConnectorDirectoryGroupAccessError } from '@/connectors/source-error'
 import type { ConnectorDirectory } from '@/connectors/types'
 
 const { mockResolveTokenUserId, mockResolveToken, mockOpenDirectory, mockAvailability } =
@@ -36,6 +37,9 @@ vi.mock('@/connectors/registry.server', () => ({
 }))
 
 import {
+  DIRECTORY_ERROR_PREFIX,
+  DIRECTORY_WARNING_PREFIX,
+  directorySyncNotice,
   refreshConnectorDirectory,
   refreshMirroredDirectory,
   syncExternalDirectoryGroups,
@@ -149,6 +153,30 @@ describe('syncExternalDirectoryGroups', () => {
     expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncedAt' in value)).toBe(false)
   })
 
+  it('does not change memberships or directory freshness after losing its lease', async () => {
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'lease' }]).mockResolvedValueOnce([])
+    await expect(
+      syncExternalDirectoryGroups({ workspaceId: 'ws-1', directory: directory() })
+    ).rejects.toThrow('Directory sync lease expired or was replaced')
+    expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncedAt' in value)).toBe(false)
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastCompleteSyncAt' in value)).toBe(
+      false
+    )
+  })
+
+  it('propagates storage failures without pruning or refreshing memberships', async () => {
+    dbChainMockFns.transaction.mockRejectedValueOnce(new Error('Storage write failed'))
+    await expect(
+      syncExternalDirectoryGroups({ workspaceId: 'ws-1', directory: directory() })
+    ).rejects.toThrow('Storage write failed')
+    expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncedAt' in value)).toBe(false)
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastCompleteSyncAt' in value)).toBe(
+      false
+    )
+  })
+
   /**
    * A truncated group listing must not prune: every directory throws rather
    * than returning a partial page, and the sync fails with it.
@@ -301,6 +329,99 @@ describe('refreshConnectorDirectory', () => {
     expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncedAt' in value)).toBe(false)
   })
 
+  it('reports inaccessible external groups as partial without refreshing their access', async () => {
+    queueTableRows(schemaMock.knowledgeConnector, [
+      connectorRow({ lastSyncError: 'Content failed' }),
+    ])
+    const providerError = new GoogleDriveApiError(403, ['forbidden'], 'directory.members.list')
+    mockOpenDirectory.mockResolvedValue(
+      directory({
+        listGroupMembers: vi.fn(async (group) => {
+          if (group.id === 'all@corp.com') {
+            throw new ConnectorDirectoryGroupAccessError('External group denied', {
+              cause: providerError,
+            })
+          }
+          return { group, memberTokens: ['u:alice@corp.com'], complete: true }
+        }),
+      })
+    )
+
+    await expect(refreshConnectorDirectory('connector-1', 'req-1')).resolves.toBe('partial')
+    const notice = dbChainMockFns.set.mock.calls.find(([value]) => 'lastSyncError' in value)?.[0]
+    expect(notice.lastSyncError).toContain(`${DIRECTORY_WARNING_PREFIX}1 group memberships`)
+    expect(notice.lastSyncError).toContain('\nContent failed')
+    expect(dbChainMockFns.set.mock.calls.filter(([value]) => 'lastSyncedAt' in value)).toHaveLength(
+      1
+    )
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastCompleteSyncAt' in value)).toBe(
+      false
+    )
+    expect(dbChainMockFns.delete).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps unknown failures blocking even when other group memberships refreshed', async () => {
+    queueTableRows(schemaMock.knowledgeConnector, [connectorRow()])
+    mockOpenDirectory.mockResolvedValue(
+      directory({
+        listGroupMembers: vi.fn(async (group) => {
+          if (group.id === 'all@corp.com') throw new Error('Connection closed')
+          return { group, memberTokens: ['u:alice@corp.com'], complete: true }
+        }),
+      })
+    )
+    await expect(refreshConnectorDirectory('connector-1', 'req-1')).rejects.toThrow(
+      '1 group memberships could not be refreshed'
+    )
+  })
+
+  it('keeps a directory with no successful memberships blocking', async () => {
+    queueTableRows(schemaMock.knowledgeConnector, [connectorRow()])
+    mockOpenDirectory.mockResolvedValue(
+      directory({
+        listGroupMembers: vi.fn().mockRejectedValue(
+          new ConnectorDirectoryGroupAccessError('External group denied', {
+            cause: new GoogleDriveApiError(403, ['forbidden'], 'directory.members.list'),
+          })
+        ),
+      })
+    )
+    await expect(refreshConnectorDirectory('connector-1', 'req-1')).rejects.toThrow(
+      '2 group memberships could not be refreshed'
+    )
+    expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncedAt' in value)).toBe(false)
+  })
+
+  it('reports a blocking error when an inaccessible external group failed first', async () => {
+    queueTableRows(schemaMock.knowledgeConnector, [connectorRow()])
+    mockOpenDirectory.mockResolvedValue(
+      directory({
+        listGroupMembers: vi.fn(async (group) => {
+          if (group.id === 'eng@corp.com') {
+            throw new ConnectorDirectoryGroupAccessError('External group denied', {
+              cause: new GoogleDriveApiError(403, ['forbidden'], 'directory.members.list'),
+            })
+          }
+          throw new GoogleDriveApiError(500, ['backendError'], 'directory.members.list')
+        }),
+      })
+    )
+    const failure = await refreshConnectorDirectory('connector-1', 'req-1').catch(
+      (error: unknown) => error
+    )
+    expect(getConnectorFailureDiagnostic(failure)).toMatchObject({
+      status: 500,
+      operation: 'directory.members.list',
+      reasons: ['backendError'],
+      phase: 'directory',
+    })
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({ lastSyncError: expect.stringContaining('HTTP 500') })
+    )
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncedAt' in value)).toBe(false)
+  })
+
   it('clears a previous directory error after a successful refresh', async () => {
     queueTableRows(schemaMock.knowledgeConnector, [
       connectorRow({ lastSyncError: 'Directory refresh failed: 403' }),
@@ -312,6 +433,35 @@ describe('refreshConnectorDirectory', () => {
     )
   })
 
+  it('clears only the recovered directory warning while preserving other diagnostics', async () => {
+    queueTableRows(schemaMock.knowledgeConnector, [
+      connectorRow({
+        lastSyncError: `${DIRECTORY_WARNING_PREFIX}1 group memberships could not be verified\nContent failed`,
+      }),
+    ])
+    mockOpenDirectory.mockResolvedValue(directory({ listGroups: vi.fn().mockResolvedValue([]) }))
+    await expect(refreshConnectorDirectory('connector-1', 'req-1')).resolves.toBe('refreshed')
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({ lastSyncError: 'Content failed' })
+    )
+  })
+
+  it.each([DIRECTORY_WARNING_PREFIX, DIRECTORY_ERROR_PREFIX])(
+    'preserves the previous directory notice when another refresh owns the lease: %s',
+    async (prefix) => {
+      const warning = `${prefix}1 group memberships could not be verified`
+      queueTableRows(schemaMock.knowledgeConnector, [
+        connectorRow({ lastSyncError: `${warning}\nContent failed` }),
+      ])
+      dbChainMockFns.returning.mockResolvedValueOnce([])
+      mockOpenDirectory.mockResolvedValue(directory())
+      await expect(refreshConnectorDirectory('connector-1', 'req-1')).resolves.toBe('skipped')
+      expect(dbChainMockFns.set.mock.calls.some(([value]) => 'lastSyncError' in value)).toBe(false)
+      expect(directorySyncNotice(`${warning}\nContent failed`)).toBe(warning)
+      expect(directorySyncNotice('Content failed')).toBeNull()
+    }
+  )
+
   it('preserves provider retry metadata through the directory failure cause', async () => {
     const { getRetryAfterMs, isRateLimitError } = await import('@/lib/knowledge/documents/utils')
     const providerError = Object.assign(new Error('quota'), { status: 429, retryAfterMs: 60_000 })
diff --git a/apps/sim/lib/knowledge/connectors/external-group-sync.ts b/apps/sim/lib/knowledge/connectors/external-group-sync.ts
index 5ea76ba69c0..be56c0abe40 100644
--- a/apps/sim/lib/knowledge/connectors/external-group-sync.ts
+++ b/apps/sim/lib/knowledge/connectors/external-group-sync.ts
@@ -32,7 +32,10 @@ import { getConnectorFailureDiagnostic } from '@/lib/knowledge/connectors/connec
 import { RUNNABLE_CONNECTOR_STATUSES } from '@/lib/knowledge/connectors/sync-lock'
 import { isRateLimitError } from '@/lib/knowledge/documents/utils'
 import { CONNECTOR_REGISTRY } from '@/connectors/registry.server'
-import { ConnectorDirectoryError } from '@/connectors/source-error'
+import {
+  ConnectorDirectoryError,
+  ConnectorDirectoryGroupAccessError,
+} from '@/connectors/source-error'
 import type {
   ConnectorConfig,
   ConnectorDirectory,
@@ -45,6 +48,44 @@ const logger = createLogger('ExternalGroupSync')
 /** Member rows written per statement while replacing a group's membership. */
 const MEMBER_WRITE_BATCH_SIZE = 500
 export const DIRECTORY_ERROR_PREFIX = 'Directory refresh failed: '
+export const DIRECTORY_WARNING_PREFIX = 'Directory refresh incomplete: '
+
+export type DirectoryRefreshResult =
+  | { status: 'refreshed' | 'skipped' }
+  | { status: 'partial'; notice: string }
+
+/** Directory workers replace only their notice, preserving content-sync diagnostics. */
+export function replaceDirectorySyncNotice(previous: string | null, notice: string | null) {
+  const contentNotices = (previous ?? '')
+    .split('\n')
+    .filter(
+      (line) =>
+        line &&
+        !line.startsWith(DIRECTORY_ERROR_PREFIX) &&
+        !line.startsWith(DIRECTORY_WARNING_PREFIX)
+    )
+  return [notice, ...contentNotices].filter(Boolean).join('\n') || null
+}
+
+export function hasDirectorySyncNotice(notice: string | null | undefined): boolean {
+  return (notice ?? '')
+    .split('\n')
+    .some(
+      (line) => line.startsWith(DIRECTORY_ERROR_PREFIX) || line.startsWith(DIRECTORY_WARNING_PREFIX)
+    )
+}
+
+/** A skipped lease has not established that an earlier directory failure recovered. */
+export function directorySyncNotice(notice: string | null | undefined): string | null {
+  return (
+    (notice ?? '')
+      .split('\n')
+      .find(
+        (line) =>
+          line.startsWith(DIRECTORY_ERROR_PREFIX) || line.startsWith(DIRECTORY_WARNING_PREFIX)
+      ) ?? null
+  )
+}
 
 interface DirectorySyncResult {
   /** Groups whose membership was replaced from a complete enumeration. */
@@ -55,6 +96,8 @@ interface DirectorySyncResult {
   pruned: number
   /** The directory is already complete and fresh, or another worker holds its lease. */
   skipped: boolean
+  /** Retained groups whose provider identified inaccessible external membership. */
+  inaccessible: number
   error?: Error
 }
 
@@ -166,7 +209,7 @@ export async function syncExternalDirectoryGroups(input: {
   const owner = resourceScopeFields(resourceScopeFromOwner(input))
   const { providerId, tenantId } = directory
   const lease = await claimDirectory({ ...owner, providerId, tenantId }, Boolean(input.force))
-  if (!lease) return { refreshed: 0, keptStale: 0, pruned: 0, skipped: true }
+  if (!lease) return { refreshed: 0, keptStale: 0, pruned: 0, skipped: true, inaccessible: 0 }
 
   try {
     const groups = await directory.listGroups()
@@ -178,7 +221,9 @@ export async function syncExternalDirectoryGroups(input: {
     })
     let refreshed = 0
     let keptStale = 0
+    let inaccessible = 0
     let firstError: Error | undefined
+    let blockingError: Error | undefined
     for (const group of groups) {
       const groupId = await withDirectoryLease(lease, (tx) =>
         upsertGroup({ ...owner, providerId, tenantId, group }, tx)
@@ -189,6 +234,8 @@ export async function syncExternalDirectoryGroups(input: {
       } catch (error) {
         if (isRateLimitError(error)) throw error
         keptStale += 1
+        if (error instanceof ConnectorDirectoryGroupAccessError) inaccessible += 1
+        else blockingError ??= toError(error)
         firstError ??= toError(error)
         const diagnostic = getConnectorFailureDiagnostic(error)
         logger.warn('Keeping last-known-good membership for a group that failed to enumerate', {
@@ -202,7 +249,7 @@ export async function syncExternalDirectoryGroups(input: {
       }
       if (!membership.complete) {
         keptStale += 1
-        firstError ??= new Error('A group membership listing was incomplete')
+        blockingError ??= new Error('A group membership listing was incomplete')
         continue
       }
       await withDirectoryLease(lease, (tx) =>
@@ -225,12 +272,14 @@ export async function syncExternalDirectoryGroups(input: {
         })
         .where(directoryIdentity(lease))
     })
+    const error = blockingError ?? firstError
     return {
       refreshed,
       keptStale,
       pruned,
       skipped: false,
-      ...(firstError && { error: firstError }),
+      inaccessible,
+      ...(error && { error }),
     }
   } finally {
     await db
@@ -336,8 +385,8 @@ async function pruneRemovedGroups(lease: DirectoryLease, keep: readonly string[]
  *
  * It is rate-limited on its own clock rather than the connector's, so a
  * frequently-syncing connector does not re-read the whole directory every run.
- * Failures retain the last confirmed membership and propagate to the caller's
- * sync status and retry policy.
+ * Inaccessible external groups retain their previous membership and report a
+ * partial refresh; other failures propagate to the caller's retry policy.
  */
 export async function refreshMirroredDirectory(input: {
   workspaceId?: string
@@ -347,9 +396,9 @@ export async function refreshMirroredDirectory(input: {
   syncContext: Record<string, unknown>
   accessToken: string
   force?: boolean
-}): Promise<'refreshed' | 'skipped'> {
+}): Promise<DirectoryRefreshResult> {
   const { workspaceId, connectorConfig } = input
-  if (!connectorConfig.openDirectory) return 'skipped'
+  if (!connectorConfig.openDirectory) return { status: 'skipped' }
 
   try {
     const directory = await connectorConfig.openDirectory(
@@ -362,7 +411,7 @@ export async function refreshMirroredDirectory(input: {
         workspaceId,
         connector: connectorConfig.id,
       })
-      return 'skipped'
+      return { status: 'skipped' }
     }
     const result = await syncExternalDirectoryGroups({
       ...resourceScopeFields(resourceScopeFromOwner(input)),
@@ -370,6 +419,16 @@ export async function refreshMirroredDirectory(input: {
       force: input.force,
     })
     if (result.keptStale > 0) {
+      if (result.refreshed > 0 && result.inaccessible === result.keptStale) {
+        const notice = `${DIRECTORY_WARNING_PREFIX}${result.keptStale} group memberships could not be verified. Previously verified access expires normally; unverified memberships grant no access. Other groups continue to sync.`
+        logger.warn('Directory refreshed with inaccessible external groups', {
+          workspaceId,
+          tenantId: directory.tenantId,
+          refreshed: result.refreshed,
+          keptStale: result.keptStale,
+        })
+        return { status: 'partial', notice }
+      }
       throw new Error(`${result.keptStale} group memberships could not be refreshed`, {
         cause: result.error,
       })
@@ -379,7 +438,7 @@ export async function refreshMirroredDirectory(input: {
       tenantId: directory.tenantId,
       ...result,
     })
-    return result.skipped ? 'skipped' : 'refreshed'
+    return { status: result.skipped ? 'skipped' : 'refreshed' }
   } catch (error) {
     const diagnostic = getConnectorFailureDiagnostic(error)
     logger.error('Directory refresh failed; serving last-known-good group membership', {
@@ -394,7 +453,7 @@ export async function refreshMirroredDirectory(input: {
   }
 }
 
-type ConnectorDirectoryRefreshOutcome = 'refreshed' | 'skipped' | 'unusable'
+type ConnectorDirectoryRefreshOutcome = 'refreshed' | 'skipped' | 'partial' | 'unusable'
 
 /**
  * Refreshes the directory one admin-mode connector mirrors, from its row.
@@ -501,19 +560,24 @@ export async function refreshConnectorDirectory(
           sourceConfig,
           syncContext,
           accessToken: token.accessToken,
-          force: connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX),
+          force: hasDirectorySyncNotice(connector.lastSyncError),
         })
-        if (
-          outcome === 'refreshed' &&
-          connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX)
+        if (outcome.status === 'partial') {
+          await recordError(replaceDirectorySyncNotice(connector.lastSyncError, outcome.notice))
+        } else if (
+          outcome.status === 'refreshed' &&
+          hasDirectorySyncNotice(connector.lastSyncError)
         ) {
-          await recordError(null)
+          await recordError(replaceDirectorySyncNotice(connector.lastSyncError, null))
         }
-        return outcome
+        return outcome.status
       } catch (error) {
         const diagnostic = getConnectorFailureDiagnostic(error)
         await recordError(
-          diagnostic ? `${DIRECTORY_ERROR_PREFIX}${diagnostic.message}` : getErrorMessage(error)
+          replaceDirectorySyncNotice(
+            connector.lastSyncError,
+            diagnostic ? `${DIRECTORY_ERROR_PREFIX}${diagnostic.message}` : getErrorMessage(error)
+          )
         )
         throw error
       }
diff --git a/apps/sim/lib/knowledge/connectors/listing-checkpoint.test.ts b/apps/sim/lib/knowledge/connectors/listing-checkpoint.test.ts
index dd8f5df65e4..fede008e1a3 100644
--- a/apps/sim/lib/knowledge/connectors/listing-checkpoint.test.ts
+++ b/apps/sim/lib/knowledge/connectors/listing-checkpoint.test.ts
@@ -262,8 +262,120 @@ describe('durable connector listing checkpoints', () => {
   })
 
   it('resumes older checkpoints without inventing permission failures', () => {
-    const legacy = omit(checkpoint(), ['permissionFailures'])
-    expect(readListingCheckpoint(legacy, fingerprint)).toMatchObject({ permissionFailures: false })
+    const legacy = omit(checkpoint(), ['permissionFailures', 'listingFailures'])
+    expect(readListingCheckpoint(legacy, fingerprint)).toMatchObject({
+      permissionFailures: false,
+      listingFailures: null,
+    })
+  })
+
+  it('persists partial-scope failures across workers and holds deletion reconciliation at EOF', async () => {
+    const failures = {
+      count: 1,
+      samples: [
+        {
+          scope: 'user@example.com',
+          operation: 'gmail.threads.list',
+          status: 400,
+          reasons: ['failedPrecondition'],
+        },
+      ],
+    }
+    const first = fixture()
+    first.listDocuments.mockResolvedValueOnce({
+      documents: [],
+      currentCursor: 'user-1',
+      nextCursor: 'user-2',
+      hasMore: true,
+      listingFailures: failures,
+    })
+    await runResumableListing({ ...first.input, maxPages: 1 })
+    const resumed = fixture(readListingCheckpoint(first.saved(), fingerprint)!)
+    resumed.listDocuments.mockResolvedValueOnce({ documents: [doc], hasMore: false })
+    expect(await runResumableListing(resumed.input)).toMatchObject({
+      complete: true,
+      unsafe: true,
+      listedCount: 1,
+      listingFailures: failures,
+    })
+  })
+
+  it('does not double-count a replayed cumulative failure snapshot', async () => {
+    const failures = {
+      count: 2,
+      samples: [
+        { scope: 'user@example.com', operation: 'calendar.events.list', status: 403, reasons: [] },
+      ],
+    }
+    const f = fixture({ ...checkpoint(), cursor: 'user-1', listingFailures: failures })
+    f.listDocuments.mockResolvedValueOnce({
+      documents: [],
+      currentCursor: 'user-1',
+      nextCursor: 'user-2',
+      hasMore: true,
+      listingFailures: failures,
+    })
+    expect(await runResumableListing({ ...f.input, maxPages: 1 })).toMatchObject({
+      listingFailures: failures,
+      unsafe: true,
+    })
+    expect(f.saved().listingFailures?.count).toBe(2)
+  })
+
+  it('clears failed-user evidence only when restarting the entire listing generation', async () => {
+    const failures = {
+      count: 1,
+      samples: [
+        {
+          scope: 'user@example.com',
+          operation: 'gmail.threads.list',
+          status: 400,
+          reasons: ['failedPrecondition'],
+        },
+      ],
+    }
+    const f = fixture({
+      ...checkpoint(),
+      cursor: 'expired',
+      unsafe: true,
+      listingFailures: failures,
+    })
+    const expired = new Error('cursor expired')
+    f.listDocuments
+      .mockRejectedValueOnce(expired)
+      .mockResolvedValueOnce({ documents: [doc], hasMore: false })
+    const result = await runResumableListing({
+      ...f.input,
+      connectorConfig: {
+        listDocuments: f.listDocuments,
+        isListingCursorInvalidError: (error) => error === expired,
+      },
+    })
+    expect(result).toMatchObject({ complete: true, unsafe: false, listingFailures: null })
+    expect(result.generationId).not.toBe('cycle-1')
+  })
+
+  it('rejects unbounded or malformed failure evidence before processing a page', async () => {
+    const f = fixture()
+    const sample = {
+      scope: 'user@example.com',
+      operation: 'gmail.threads.list',
+      status: 400,
+      reasons: ['failedPrecondition'],
+    }
+    f.listDocuments.mockResolvedValueOnce({
+      documents: [doc],
+      hasMore: false,
+      listingFailures: { count: 11, samples: Array(11).fill(sample) },
+    })
+    await expect(runResumableListing(f.input)).rejects.toThrow()
+    expect(f.processPage).not.toHaveBeenCalled()
+    expect(
+      readListingCheckpoint(
+        { ...checkpoint(), listingFailures: { count: -1, samples: [] } },
+        fingerprint
+      )
+    ).toBeNull()
   })
 
   it('rejects checkpoints from a changed configuration or malformed serialized value', () => {
diff --git a/apps/sim/lib/knowledge/connectors/listing-checkpoint.ts b/apps/sim/lib/knowledge/connectors/listing-checkpoint.ts
index 7ca43030d82..476a8bfb86a 100644
--- a/apps/sim/lib/knowledge/connectors/listing-checkpoint.ts
+++ b/apps/sim/lib/knowledge/connectors/listing-checkpoint.ts
@@ -6,6 +6,7 @@ import {
   addSourcePagePayloadBytes,
   ConnectorSyncCapacityError,
 } from '@/lib/knowledge/connectors/sync-primitives'
+import { listingFailuresSchema } from '@/connectors/listing-failures'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 
 const checkpointSchema = z.object({
@@ -22,6 +23,7 @@ const checkpointSchema = z.object({
   unsafe: z.boolean(),
   contentFailures: z.boolean().default(false),
   permissionFailures: z.boolean().default(false),
+  listingFailures: listingFailuresSchema.nullable().default(null),
   changeCursor: z
     .string()
     .max(512 * 1024)
@@ -68,6 +70,7 @@ export function beginListingCheckpoint(input: {
     unsafe: false,
     contentFailures: false,
     permissionFailures: false,
+    listingFailures: null,
     changeCursor: input.changeCursor ?? null,
     incrementalSince: input.incrementalSince?.toISOString() ?? null,
     forceRehydrate: input.forceRehydrate ?? false,
@@ -135,6 +138,7 @@ export async function runResumableListing(input: {
         unsafe: false,
         contentFailures: false,
         permissionFailures: false,
+        listingFailures: null,
       }
       await input.saveCheckpoint(checkpoint)
       cursors.clear()
@@ -152,11 +156,15 @@ export async function runResumableListing(input: {
     }
     checkpoint.unsafe ||=
       response.reconciliationSafe === false ||
+      response.listingFailures !== undefined ||
       Boolean(
         input.syncContext.listingCapped ||
           input.syncContext.listingTruncated ||
           input.syncContext.reconciliationUnsafe
       )
+    if (response.listingFailures) {
+      checkpoint.listingFailures = listingFailuresSchema.parse(response.listingFailures)
+    }
     if (response.currentCursor !== undefined && response.currentCursor !== checkpoint.cursor) {
       if (response.currentCursor.length > 512 * 1024)
         throw new ConnectorSyncCapacityError('Connector returned an oversized listing cursor')
diff --git a/apps/sim/lib/knowledge/connectors/member-observations.test.ts b/apps/sim/lib/knowledge/connectors/member-observations.test.ts
index 79ccd3b5430..3c7d0a41ab0 100644
--- a/apps/sim/lib/knowledge/connectors/member-observations.test.ts
+++ b/apps/sim/lib/knowledge/connectors/member-observations.test.ts
@@ -162,6 +162,7 @@ describe('applyMemberDocumentLifecycle', () => {
 
   it('tombstones in bounded transactions and leaves remaining work for the next run', async () => {
     const batch = Array.from({ length: 500 }, (_, i) => ({ id: `document-${i}` }))
+    queueTableRows(schemaMock.document, batch)
     dbChainMockFns.returning.mockResolvedValueOnce(batch)
     const input: Parameters<typeof applyMemberDocumentLifecycle>[0] = {
       connectorId: 'c-1',
@@ -184,6 +185,8 @@ describe('applyMemberDocumentLifecycle', () => {
     })
     expect(dbChainMockFns.limit).toHaveBeenCalledWith(500)
     dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'remaining' }]).mockResolvedValueOnce([])
+    queueTableRows(schemaMock.document, [{ id: 'remaining' }])
+    queueTableRows(schemaMock.document, [])
     queueTableRows(schemaMock.document, [])
     expect(
       await applyMemberDocumentLifecycle({ ...input, deadlineAt: Date.now() + 60_000 })
@@ -197,6 +200,8 @@ describe('applyMemberDocumentLifecycle', () => {
 
   it('reports a reclaimed lease during a purge batch as the run being superseded', async () => {
     dbChainMockFns.returning.mockResolvedValueOnce([])
+    queueTableRows(schemaMock.document, [])
+    queueTableRows(schemaMock.document, [])
     queueTableRows(schemaMock.document, [{ id: 'd-1' }])
     vi.mocked(hardDeleteDocuments).mockRejectedValueOnce(
       new ConnectorSyncDeletionGuardError('lease reclaimed')
diff --git a/apps/sim/lib/knowledge/connectors/member-observations.ts b/apps/sim/lib/knowledge/connectors/member-observations.ts
index ab9efdbd53b..cd3123a5e16 100644
--- a/apps/sim/lib/knowledge/connectors/member-observations.ts
+++ b/apps/sim/lib/knowledge/connectors/member-observations.ts
@@ -7,6 +7,7 @@ import {
 } from '@sim/db/schema'
 import {
   and,
+  asc,
   eq,
   exists,
   gt,
@@ -291,31 +292,53 @@ export async function applyMemberDocumentLifecycle(input: {
   }
   for (const phase of ['tombstoned', 'resurrected'] as const) {
     if (phase === 'tombstoned' && !input.allowRemoval) continue
+    const seenOrder = sql`COALESCE(${document.sourceSeenAt}, '-infinity'::timestamp)`
+    let after: { id: string; seenAt: string } | undefined
     for (;;) {
       if (Date.now() >= input.deadlineAt) return result
       await input.lease.beatIfDue()
-      const changed = await input.withLease(async (tx) => {
-        const condition = and(
-          eq(document.connectorId, connectorId),
-          eq(document.userExcluded, false),
-          isNull(document.archivedAt),
-          phase === 'tombstoned'
-            ? and(isNull(document.deletedAt), hasNoObservation())
-            : and(isNotNull(document.deletedAt), isNotNull(document.contentHash), hasObservation())
+      const condition = and(
+        eq(document.connectorId, connectorId),
+        eq(document.userExcluded, false),
+        isNull(document.archivedAt),
+        phase === 'tombstoned'
+          ? and(isNull(document.deletedAt), hasNoObservation())
+          : and(isNotNull(document.deletedAt), isNotNull(document.contentHash), hasObservation())
+      )
+      /** Materialize the limited IDs before UPDATE so its observation check stays batch-bound. */
+      const candidates = await db
+        .select({ id: document.id, seenAt: sql<string>`${seenOrder}::text` })
+        .from(document)
+        .where(
+          and(
+            condition,
+            after
+              ? sql`(${seenOrder}, ${document.id}) > (${after.seenAt}::timestamp, ${after.id})`
+              : undefined
+          )
         )
-        const candidates = tx
-          .select({ id: document.id })
-          .from(document)
-          .where(condition)
-          .limit(MATERIALIZE_BATCH_SIZE)
+        .orderBy(seenOrder, asc(document.id))
+        .limit(MATERIALIZE_BATCH_SIZE)
+      if (candidates.length === 0) break
+      if (Date.now() >= input.deadlineAt) return result
+      const changed = await input.withLease(async (tx) => {
         return tx
           .update(document)
           .set({ deletedAt: phase === 'tombstoned' ? now : null })
-          .where(and(condition, inArray(document.id, candidates)))
+          .where(
+            and(
+              condition,
+              inArray(
+                document.id,
+                candidates.map(({ id }) => id)
+              )
+            )
+          )
           .returning({ id: document.id })
       })
       result[phase] += changed.length
-      if (changed.length < MATERIALIZE_BATCH_SIZE) break
+      after = candidates.at(-1)
+      if (candidates.length < MATERIALIZE_BATCH_SIZE) break
     }
   }
 
diff --git a/apps/sim/lib/knowledge/connectors/sync-content-pass.test.ts b/apps/sim/lib/knowledge/connectors/sync-content-pass.test.ts
index 798459d4d88..59b87aca767 100644
--- a/apps/sim/lib/knowledge/connectors/sync-content-pass.test.ts
+++ b/apps/sim/lib/knowledge/connectors/sync-content-pass.test.ts
@@ -385,6 +385,35 @@ function contentWrite(): Record<string, unknown> {
 }
 
 describe('content pass checkpoint intent', () => {
+  it('does not reconcile deletions after a user listing failed, even without the unsafe marker', async () => {
+    sourceBody = { value: '<p>Current content</p>' }
+    const checkpoint = {
+      ...beginListingCheckpoint({
+        fingerprint: 'a'.repeat(64),
+        generationId: 'prior',
+        startedAt: new Date(0),
+      }),
+      listingFailures: {
+        count: 1,
+        samples: [
+          {
+            scope: 'unavailable@example.com',
+            operation: 'gmail.threads.list',
+            status: 400,
+            reasons: ['failedPrecondition'],
+          },
+        ],
+      },
+    }
+    const { pass, result } = await runPass({ checkpoint, access: 'admin' })
+    expect(pass.complete).toBe(true)
+    expect(pass.checkpoint.listingFailures).toEqual(checkpoint.listingFailures)
+    expect(pass.holdNotice).toContain('unlisted documents were kept')
+    expect(result.docsDeleted).toBe(0)
+    expect(mocks.hardDelete).not.toHaveBeenCalled()
+    expect(dbChainMockFns.set.mock.calls.some(([value]) => value.deletedAt != null)).toBe(false)
+  })
+
   it('persists unresolved permissions independently of successful content processing', async () => {
     sourceBody = { value: '<p>Current content</p>' }
     mocks.onPage.mockResolvedValue({ permissionsIncomplete: true })
diff --git a/apps/sim/lib/knowledge/connectors/sync-content-pass.ts b/apps/sim/lib/knowledge/connectors/sync-content-pass.ts
index 7ef42e94c5e..6fc86b716fb 100644
--- a/apps/sim/lib/knowledge/connectors/sync-content-pass.ts
+++ b/apps/sim/lib/knowledge/connectors/sync-content-pass.ts
@@ -224,7 +224,7 @@ async function reconcileCompletedListing(
   checkpoint: ListingCheckpoint,
   withLease: <T>(fn: (tx: DbOrTx) => Promise<T>) => Promise<T>
 ): Promise<{ finished: boolean; notice: string | null }> {
-  if (checkpoint.unsafe)
+  if (checkpoint.unsafe || (checkpoint.listingFailures?.count ?? 0) > 0)
     return {
       finished: true,
       notice:
diff --git a/apps/sim/lib/knowledge/connectors/sync-engine.test.ts b/apps/sim/lib/knowledge/connectors/sync-engine.test.ts
index ea8dc8c500a..29ad7d9d714 100644
--- a/apps/sim/lib/knowledge/connectors/sync-engine.test.ts
+++ b/apps/sim/lib/knowledge/connectors/sync-engine.test.ts
@@ -2142,6 +2142,78 @@ describe('completeSuccessfulSync', () => {
     resetDbChainMock()
   })
 
+  it.each([false, true])(
+    'preserves directory and listing notices without blocking healthy content watermarks: listing failure %s',
+    async (hasListingFailure) => {
+      const { completeSuccessfulSync } = await import('@/lib/knowledge/connectors/sync-engine')
+      queueTableRows(schemaMock.knowledgeBase, [{ id: 'kb-1' }])
+      queueTableRows(schemaMock.knowledgeConnector, [{ id: 'c-1' }])
+      queueTableRows(schemaMock.document, [{ count: 4 }])
+      dbChainMockFns.returning
+        .mockResolvedValueOnce([])
+        .mockResolvedValueOnce([{ id: 'log-1' }])
+        .mockResolvedValueOnce([{ id: 'c-1' }])
+      const directoryNotice =
+        'Directory refresh incomplete: 1 group membership could not be verified.'
+      const contentNotice = 'Unlisted documents were kept.'
+
+      await expect(
+        completeSuccessfulSync(
+          'c-1',
+          'kb-1',
+          'log-1',
+          60,
+          { ...RESULT, docsFailed: 0 },
+          contentNotice,
+          {
+            complete: true,
+            checkpoint: {
+              unsafe: hasListingFailure,
+              startedAt: '2026-09-04T00:00:00Z',
+              listedCount: 4,
+              listingFailures: hasListingFailure
+                ? {
+                    count: 1,
+                    samples: [
+                      {
+                        scope: 'unavailable@example.com',
+                        operation: 'gmail.threads.list',
+                        status: 400,
+                        reasons: ['failedPrecondition'],
+                      },
+                    ],
+                  }
+                : null,
+            },
+          },
+          directoryNotice
+        )
+      ).resolves.toBe(true)
+
+      const logUpdate = dbChainMockFns.set.mock.calls.find(
+        ([value]) => value.status === 'partial'
+      )?.[0]
+      const connectorUpdate = dbChainMockFns.set.mock.calls.find(
+        ([value]) => value.status === 'active'
+      )?.[0]
+      expect(logUpdate.errorMessage).toContain(directoryNotice)
+      expect(logUpdate.errorMessage).toContain(contentNotice)
+      expect(connectorUpdate.lastSyncError).toBe(logUpdate.errorMessage)
+      expect(connectorUpdate.listingCheckpoint).toBeNull()
+      expect(connectorUpdate.consecutiveFailures).toBe(0)
+      expect(connectorUpdate.nextSyncAt.getTime()).toBeGreaterThan(Date.now() + 50 * 60_000)
+      if (hasListingFailure) {
+        expect(connectorUpdate).not.toHaveProperty('lastSyncAt')
+        expect(logUpdate.errorMessage).toContain(
+          'unavailable@example.com (gmail.threads.list, HTTP 400, failedPrecondition)'
+        )
+        expect(logUpdate.errorMessage).toContain('next scheduled sync')
+      } else {
+        expect(connectorUpdate.lastSyncAt).toEqual(new Date('2026-09-04T00:00:00Z'))
+      }
+    }
+  )
+
   it('commits the completed log and connector state in one guarded transaction', async () => {
     const { completeSuccessfulSync } = await import('@/lib/knowledge/connectors/sync-engine')
 
diff --git a/apps/sim/lib/knowledge/connectors/sync-engine.ts b/apps/sim/lib/knowledge/connectors/sync-engine.ts
index dccaf32d775..5632d2e6a43 100644
--- a/apps/sim/lib/knowledge/connectors/sync-engine.ts
+++ b/apps/sim/lib/knowledge/connectors/sync-engine.ts
@@ -33,7 +33,9 @@ import {
 } from '@/lib/knowledge/connectors/access-token'
 import { getConnectorFailureDiagnostic } from '@/lib/knowledge/connectors/connector-error'
 import {
-  DIRECTORY_ERROR_PREFIX,
+  type DirectoryRefreshResult,
+  directorySyncNotice,
+  hasDirectorySyncNotice,
   refreshMirroredDirectory,
 } from '@/lib/knowledge/connectors/external-group-sync'
 import { listingFingerprint } from '@/lib/knowledge/connectors/listing-checkpoint'
@@ -86,6 +88,7 @@ import type {
   ConnectorAuthConfig,
   ConnectorConfig,
   ExternalDocument,
+  ExternalListingFailures,
   SyncResult,
 } from '@/connectors/types'
 
@@ -298,6 +301,7 @@ export interface ContentPassOutcome {
     unsafe: boolean
     contentFailures?: boolean
     permissionFailures?: boolean
+    listingFailures?: ExternalListingFailures | null
     startedAt: string
     listedCount: number
     incrementalSince?: string | null
@@ -315,7 +319,8 @@ export function isContentPassIncomplete(
   return (
     !contentPass.complete ||
     contentPass.checkpoint.contentFailures === true ||
-    contentPass.checkpoint.permissionFailures === true
+    contentPass.checkpoint.permissionFailures === true ||
+    (contentPass.checkpoint.listingFailures?.count ?? 0) > 0
   )
 }
 
@@ -333,14 +338,33 @@ export async function completeSuccessfulSync(
   syncIntervalMinutes: number,
   result: SyncResult,
   reconciliationHoldNotice: string | null,
-  contentPass?: ContentPassOutcome
+  contentPass?: ContentPassOutcome,
+  directoryNotice: string | null = null
 ): Promise<boolean> {
   const processingDispatchFailed = result.processingDispatch.failed > 0
-  const completionNotice =
+  const contentNotice =
     reconciliationHoldNotice ??
     (processingDispatchFailed
       ? 'Some documents could not be queued for indexing. They will be retried automatically.'
       : null)
+  const listingFailures = contentPass?.checkpoint.listingFailures
+  const failedAccounts = listingFailures?.samples
+    .map((failure) => {
+      const details = [
+        failure.operation,
+        failure.status ? `HTTP ${failure.status}` : null,
+        ...failure.reasons,
+      ]
+        .filter(Boolean)
+        .join(', ')
+      return `${failure.scope} (${details})`
+    })
+    .join('; ')
+  const listingNotice = listingFailures?.count
+    ? `Source listing failed for ${listingFailures.count} ${listingFailures.count === 1 ? 'account' : 'accounts'}.${failedAccounts ? ` ${failedAccounts}.` : ''} Failed accounts will be retried at the next scheduled sync.`
+    : null
+  const completionNotice =
+    [directoryNotice, listingNotice, contentNotice].filter(Boolean).join('\n') || null
   try {
     return await db.transaction(async (tx) => {
       const [lockedKnowledgeBase] = await tx
@@ -389,7 +413,9 @@ export async function completeSuccessfulSync(
         .update(knowledgeConnectorSyncLog)
         .set({
           status:
-            processingDispatchFailed || (contentPass && isContentPassIncomplete(contentPass))
+            directoryNotice ||
+            processingDispatchFailed ||
+            (contentPass && isContentPassIncomplete(contentPass))
               ? 'partial'
               : 'completed',
           completedAt: now,
@@ -1043,7 +1069,9 @@ export async function executeSync(
         (options?.rehydrate || options?.fullSync) && connectorConfig.rehydrateOnFullSync
       )
 
-      let directoryRefreshed: Promise<Error | undefined> = Promise.resolve(undefined)
+      let directoryRefreshed: Promise<DirectoryRefreshResult | Error> = Promise.resolve({
+        status: 'skipped',
+      })
       if (mirrored) {
         /**
          * A switch into this mode hides every document before it flips, and one
@@ -1077,8 +1105,8 @@ export async function executeSync(
           force:
             Boolean(options.fullSync) ||
             connector.consecutiveFailures > 0 ||
-            connector.lastSyncError?.startsWith(DIRECTORY_ERROR_PREFIX),
-        }).then(() => undefined, toError)
+            hasDirectorySyncNotice(connector.lastSyncError),
+        }).catch(toError)
       }
 
       const contentPass = await runConnectorContentPass({
@@ -1140,8 +1168,14 @@ export async function executeSync(
 
       result.listingIncomplete = isContentPassIncomplete(contentPass)
       const reconciliationHoldNotice = contentPass.holdNotice
-      const directoryError = await directoryRefreshed
-      if (directoryError) throw directoryError
+      const directoryOutcome = await directoryRefreshed
+      if (directoryOutcome instanceof Error) throw directoryOutcome
+      const directoryNotice =
+        directoryOutcome.status === 'partial'
+          ? directoryOutcome.notice
+          : directoryOutcome.status === 'skipped' && mirrored
+            ? directorySyncNotice(connector.lastSyncError)
+            : null
 
       const postBatchPresence = await checkSyncTargetPresence(
         connectorId,
@@ -1171,7 +1205,8 @@ export async function executeSync(
         effectiveConnectorSyncIntervalMinutes(connector.accessMode, connector.syncIntervalMinutes),
         result,
         reconciliationHoldNotice,
-        contentPass
+        contentPass,
+        directoryNotice
       )
 
       if (!completionLanded) {
diff --git a/apps/sim/lib/knowledge/documents/document-processing-source.test.ts b/apps/sim/lib/knowledge/documents/document-processing-source.test.ts
index 73ff94ee27d..dd0941ad827 100644
--- a/apps/sim/lib/knowledge/documents/document-processing-source.test.ts
+++ b/apps/sim/lib/knowledge/documents/document-processing-source.test.ts
@@ -805,6 +805,110 @@ describe('processDocumentAsync write guards', () => {
     ).toBe(false)
   })
 
+  it('writes every chunk in bounded batches before completing the document', async () => {
+    armProviderSource()
+    const chunks = Array.from({ length: 205 }, (_, index) => ({
+      text: `Chunk ${index}`,
+      metadata: { startIndex: index * 10, endIndex: index * 10 + 9 },
+    }))
+    mockProcessDocument.mockResolvedValueOnce({
+      chunks,
+      metadata: { chunkCount: chunks.length, tokenCount: 615, characterCount: 2050 },
+    })
+    mockGenerateEmbeddings.mockResolvedValueOnce({
+      embeddings: chunks.map((_, index) => [index / chunks.length]),
+      billableTokens: 0,
+      modelName: 'text-embedding-3-small',
+      pricingId: 'text-embedding-3-small',
+    })
+
+    await processDocumentAsync(
+      'knowledge-base-1',
+      'document-1',
+      {
+        filename: 'a.txt',
+        fileUrl: 'https://example.com/a.txt',
+        fileSize: 2050,
+        mimeType: 'text/plain',
+      },
+      {},
+      BILLING_ATTRIBUTION
+    )
+
+    const batches = dbChainMockFns.values.mock.calls
+      .map(([value]) => value)
+      .filter((value) => Array.isArray(value) && value[0]?.documentId === 'document-1')
+    expect(batches.map((batch) => batch.length)).toEqual([100, 100, 5])
+    expect(batches.flat().map((record) => record.chunkIndex)).toEqual(
+      chunks.map((_, index) => index)
+    )
+    expect(batches.flat().map((record) => record.content)).toEqual(
+      chunks.map((chunk) => chunk.text)
+    )
+    expect(batches.flat().map((record) => record.embedding)).toEqual(
+      chunks.map((_, index) => [index / chunks.length])
+    )
+    expect(dbChainMockFns.transaction).toHaveBeenCalledOnce()
+    expect(guardForStatusWrite('completed')).toBeDefined()
+    const completionIndex = dbChainMockFns.set.mock.calls.findIndex(
+      ([value]) => value.processingStatus === 'completed'
+    )
+    expect(dbChainMockFns.set.mock.invocationCallOrder[completionIndex]).toBeGreaterThan(
+      Math.max(...dbChainMockFns.values.mock.invocationCallOrder)
+    )
+  })
+
+  it('aborts the document transaction when a later embedding batch fails', async () => {
+    armProviderSource()
+    const chunks = Array.from({ length: 205 }, (_, index) => ({
+      text: `Chunk ${index}`,
+      metadata: { startIndex: index * 10, endIndex: index * 10 + 9 },
+    }))
+    mockProcessDocument.mockResolvedValueOnce({
+      chunks,
+      metadata: { chunkCount: chunks.length, tokenCount: 615, characterCount: 2050 },
+    })
+    mockGenerateEmbeddings.mockResolvedValueOnce({
+      embeddings: chunks.map(() => [0.1]),
+      billableTokens: 0,
+      modelName: 'text-embedding-3-small',
+      pricingId: 'text-embedding-3-small',
+    })
+    const databaseError = new DrizzleQueryError(
+      'insert private SQL',
+      ['private content'],
+      Object.assign(new Error('canceling statement due to statement timeout'), { code: '57014' })
+    )
+    dbChainMockFns.values.mockResolvedValueOnce([]).mockRejectedValueOnce(databaseError)
+
+    await expect(
+      processDocumentAsync(
+        'knowledge-base-1',
+        'document-1',
+        {
+          filename: 'a.txt',
+          fileUrl: 'https://example.com/a.txt',
+          fileSize: 2050,
+          mimeType: 'text/plain',
+        },
+        {},
+        BILLING_ATTRIBUTION
+      )
+    ).rejects.toBe(databaseError)
+
+    expect(dbChainMockFns.transaction).toHaveBeenCalledOnce()
+    await expect(dbChainMockFns.transaction.mock.results[0].value).rejects.toBe(databaseError)
+    expect(dbChainMockFns.values).toHaveBeenCalledTimes(2)
+    expect(mockLogError).toHaveBeenCalledWith(
+      '[document-1] Failed to insert embedding batch',
+      expect.objectContaining({ batchNumber: 2, batchSize: 100, totalChunks: 205 })
+    )
+    expect(
+      dbChainMockFns.set.mock.calls.some(([value]) => value.processingStatus === 'completed')
+    ).toBe(false)
+    expect(guardForStatusWrite('failed')).toBeDefined()
+  })
+
   it('accepts a legacy queuedAt-only payload only while the row has no token', async () => {
     dbChainMockFns.limit
       .mockResolvedValueOnce([PERSISTED_CONTEXT])
diff --git a/apps/sim/lib/knowledge/documents/service.ts b/apps/sim/lib/knowledge/documents/service.ts
index 50699895060..1aac135fb6e 100644
--- a/apps/sim/lib/knowledge/documents/service.ts
+++ b/apps/sim/lib/knowledge/documents/service.ts
@@ -329,7 +329,8 @@ const TIMEOUTS = {
 } as const
 
 const LARGE_DOC_CONFIG = {
-  MAX_CHUNKS_PER_BATCH: 500,
+  /** Each chunk also updates search projections and indexes inside the same statement. */
+  MAX_CHUNKS_PER_BATCH: 100,
   MAX_EMBEDDING_BATCH: Math.min(
     envNumber(env.KB_CONFIG_BATCH_SIZE, 2000, { min: 1, integer: true }),
     getEmbeddingAggregateItemLimit(MAX_KB_EMBEDDING_DIMENSIONS)
diff --git a/apps/sim/lib/sim-search/search-params.test.ts b/apps/sim/lib/sim-search/search-params.test.ts
new file mode 100644
index 00000000000..39a109dea40
--- /dev/null
+++ b/apps/sim/lib/sim-search/search-params.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import { searchSetupParam, searchSetupReturnParam } from '@/lib/sim-search/search-params'
+import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
+
+describe('Search setup navigation', () => {
+  it('can open and resume every source advertised by the connector registry', () => {
+    for (const [type, meta] of Object.entries(CONNECTOR_META_REGISTRY)) {
+      if (!meta.search) continue
+      expect(searchSetupParam.parser.parse(type), type).toBe(type)
+      expect(searchSetupReturnParam.parser.parse(type), type).toBe(type)
+    }
+  })
+
+  it('rejects arbitrary redirects and keeps the empty picker value', () => {
+    expect(searchSetupParam.parser.parse('')).toBe('')
+    expect(searchSetupParam.parser.parse('https://example.com')).toBeNull()
+    expect(searchSetupReturnParam.parser.parse('https://example.com')).toBeNull()
+  })
+})
diff --git a/apps/sim/lib/sim-search/search-params.ts b/apps/sim/lib/sim-search/search-params.ts
index 3d0116eb784..408892987ee 100644
--- a/apps/sim/lib/sim-search/search-params.ts
+++ b/apps/sim/lib/sim-search/search-params.ts
@@ -1,6 +1,7 @@
 import { parseAsString, parseAsStringLiteral } from 'nuqs/server'
 
 const SEARCH_SETUP_SOURCES = [
+  'coda',
   'confluence',
   'github',
   'gitlab',
diff --git a/apps/sim/public/library/ai-agent-examples-by-department-and-industry/cover.jpg b/apps/sim/public/library/ai-agent-examples-by-department-and-industry/cover.jpg
new file mode 100644
index 00000000000..d1b0d9c64bb
Binary files /dev/null and b/apps/sim/public/library/ai-agent-examples-by-department-and-industry/cover.jpg differ
diff --git a/apps/sim/public/library/ai-native-workflow-automation-vs-traditional-automation/cover.jpg b/apps/sim/public/library/ai-native-workflow-automation-vs-traditional-automation/cover.jpg
new file mode 100644
index 00000000000..bf10630200c
Binary files /dev/null and b/apps/sim/public/library/ai-native-workflow-automation-vs-traditional-automation/cover.jpg differ
diff --git a/apps/sim/tools/coda/utils.ts b/apps/sim/tools/coda/utils.ts
index bf44386e11a..ff665e5541d 100644
--- a/apps/sim/tools/coda/utils.ts
+++ b/apps/sim/tools/coda/utils.ts
@@ -16,6 +16,7 @@ import type { OutputProperty, ToolConfig, ToolRetryConfig } from '@/tools/types'
 import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const CODA_API_BASE = 'https://coda.io/apis/v1'
+const CODA_ADMIN_API_BASE = 'https://coda.io/apis/admin/v1'
 
 type QueryValue = string | number | boolean | null | undefined
 
@@ -25,8 +26,12 @@ type QueryValue = string | number | boolean | null | undefined
  * already encodes the original query, and Coda rejects any other parameter sent with it
  * (for example `limit` on pages, or `useColumnNames` on rows), so only the token is sent.
  */
-export function buildCodaUrl(path: string, query?: Record<string, QueryValue>): string {
-  const url = new URL(`${CODA_API_BASE}${path}`)
+export function buildCodaUrl(
+  path: string,
+  query?: Record<string, QueryValue>,
+  api: 'public' | 'admin' = 'public'
+): string {
+  const url = new URL(`${api === 'admin' ? CODA_ADMIN_API_BASE : CODA_API_BASE}${path}`)
   const pageToken = query?.pageToken
   const effectiveQuery =
     typeof pageToken === 'string' && pageToken.trim() !== '' ? { pageToken } : (query ?? {})
diff --git a/apps/sim/tools/http/request.test.ts b/apps/sim/tools/http/request.test.ts
index 661239c7cbd..df59cabbd85 100644
--- a/apps/sim/tools/http/request.test.ts
+++ b/apps/sim/tools/http/request.test.ts
@@ -70,6 +70,43 @@ describe('HTTP Request Tool', () => {
       expect(url.includes('chars')).toBe(true)
     })
 
+    it.concurrent('substitutes path parameters only by their whole name', () => {
+      expect(processUrl('https://www.google.com', { '': '' })).toBe('https://www.google.com')
+      expect(processUrl('https://api.example.com:8443/users/:id', { '8443': 'x', id: '42' })).toBe(
+        'https://api.example.com:8443/users/42'
+      )
+      expect(processUrl('https://api.example.com/users/:idx/:id', { id: '1', idx: '2' })).toBe(
+        'https://api.example.com/users/2/1'
+      )
+      expect(processUrl('https://api.example.com/users/:id-profile', { id: '7' })).toBe(
+        'https://api.example.com/users/7-profile'
+      )
+      expect(processUrl('https://api.example.com/users/:user-id', { 'user-id': '9' })).toBe(
+        'https://api.example.com/users/9'
+      )
+      expect(processUrl('https://api.example.com/users/:id', { id: '$&' })).toBe(
+        'https://api.example.com/users/%24%26'
+      )
+      expect(processUrl('https://api.example.com/users/:user.name', { 'user.name': 'ada' })).toBe(
+        'https://api.example.com/users/ada'
+      )
+      expect(processUrl('https://api.example.com/v1/:$ref', { $ref: 'x' })).toBe(
+        'https://api.example.com/v1/x'
+      )
+      expect(processUrl('https://api.example.com/users/:id', { '/': 'x', '1': 'y' })).toBe(
+        'https://api.example.com/users/:id'
+      )
+      expect(
+        processUrl('https://api.example.com/:user-id/:user', { user: 'alice', 'user-id': '42' })
+      ).toBe('https://api.example.com/42/alice')
+      expect(
+        processUrl('https://api.example.com/:user.name', { user: 'alice', 'user.name': 'ada' })
+      ).toBe('https://api.example.com/ada')
+      expect(processUrl('https://api.example.com/:é/:éa', { é: '42', éa: '7' })).toBe(
+        'https://api.example.com/42/7'
+      )
+    })
+
     it.concurrent('canonicalizes first-party API calls before the apex redirect', () => {
       expect(
         processUrl('https://sim.ai/api/v2/workflows', undefined, [
diff --git a/apps/sim/tools/http/utils.ts b/apps/sim/tools/http/utils.ts
index 22cba3b2647..0495fb3073c 100644
--- a/apps/sim/tools/http/utils.ts
+++ b/apps/sim/tools/http/utils.ts
@@ -1,3 +1,4 @@
+import { escapeRegExp } from '@/executor/constants'
 import { transformTable } from '@/tools/shared/table'
 import type { TableRow } from '@/tools/types'
 
@@ -81,6 +82,37 @@ export const getDefaultHeaders = (
   return headers
 }
 
+/**
+ * A path parameter key must start like a JavaScript identifier, using the same character classes
+ * path-to-regexp uses for `:name` parameters. That excludes an empty key and one starting with a
+ * digit or `/`, the shapes that matched the scheme separator or a port; the rest of the key is left
+ * as callers use it.
+ */
+const PATH_PARAM_KEY = /^[$_\p{ID_Start}][^\s/?#]*$/u
+const PATH_PARAM_NAME_CONTINUE = '[$\\u200c\\u200d\\p{ID_Continue}]'
+
+/**
+ * Replaces the first `:key` placeholder for each path parameter with its URL-encoded value.
+ *
+ * A placeholder ends where an identifier would, so `:id` never matches inside `:idx`, and longer
+ * keys are substituted first, so `:user-id` is not consumed by a `user` key. A plain string replace
+ * let an empty key strip the scheme's colon (`https://` became `https//`), a numeric key rewrite a
+ * port, and `:id` match inside `:idx`.
+ */
+function substitutePathParams(url: string, pathParams: Record<string, string>): string {
+  const entries = Object.entries(pathParams)
+    .filter(([key]) => PATH_PARAM_KEY.test(key))
+    .sort(([a], [b]) => b.length - a.length)
+  let substituted = url
+  for (const [key, value] of entries) {
+    substituted = substituted.replace(
+      new RegExp(`:${escapeRegExp(key)}(?!${PATH_PARAM_NAME_CONTINUE})`, 'u'),
+      () => encodeURIComponent(value)
+    )
+  }
+  return substituted
+}
+
 /**
  * Processes a URL with path parameters and query parameters
  * @param url Base URL to process
@@ -98,9 +130,7 @@ export const processUrl = (
   }
 
   if (pathParams) {
-    Object.entries(pathParams).forEach(([key, value]) => {
-      url = url.replace(`:${key}`, encodeURIComponent(value))
-    })
+    url = substitutePathParams(url, pathParams)
   }
 
   if (queryParams) {
diff --git a/packages/deployment-config/src/integration-availability.ts b/packages/deployment-config/src/integration-availability.ts
index 86a5e923257..0be1458546a 100644
--- a/packages/deployment-config/src/integration-availability.ts
+++ b/packages/deployment-config/src/integration-availability.ts
@@ -29,6 +29,12 @@ const deploymentGatedIntegrationTypes = new Set(
 const integrationTypesByOAuthServiceId = new Map<string, readonly string[]>()
 /** Search authorization shares GitHub's integration policy while its workflow tools retain PAT auth. */
 integrationTypesByOAuthServiceId.set('github-repositories', ['github_v2'])
+/** Coda's stored API-token credential is available without a deployment OAuth client. */
+const tokenCredentialIntegrationTypes = new Map([['coda', 'coda']])
+for (const [serviceId, integrationType] of tokenCredentialIntegrationTypes) {
+  integrationTypesByOAuthServiceId.set(serviceId, [integrationType])
+}
+const tokenCredentialTypes = new Set(tokenCredentialIntegrationTypes.values())
 const previewServiceAccountProvidersByIntegrationType = new Map<string, string>()
 for (const integration of INTEGRATION_METADATA) {
   if (integration.authType !== 'oauth' || !integration.oauthServiceId) continue
@@ -144,7 +150,7 @@ export function resolveIntegrationAvailability(
       name: integration.name,
       state: 'ready',
       oauthAvailable: false,
-      serviceAccountAvailable: false,
+      serviceAccountAvailable: tokenCredentialTypes.has(integration.type),
       missingFields: [],
     }
   })