@@ -215,41 +215,73 @@ describe('Confluence attachment listing', () => {
     expect(last.hasMore).toBe(false)
   })
 
-  it.each([403, 401])(
-    'preserves parent pages and cumulative partial progress for attachment access failure %s',
+  it('preserves parent pages and cumulative partial progress when the attachment scope is missing', async () => {
+    fetchMock.mockImplementation(async () =>
+      Response.json({ code: 401, message: 'Unauthorized; scope does not match' }, { status: 401 })
+    )
+    const listParents = vi.fn(
+      async (cursor: string | undefined): Promise<ExternalDocumentList> => ({
+        documents: [parent(cursor ? 'p2' : 'p1')],
+        hasMore: !cursor,
+        nextCursor: cursor ? undefined : 'next',
+      })
+    )
+    const first = await listConfluenceAttachments({ ...INPUT, listParents })
+    const context: Record<string, unknown> = {}
+    const last = await listConfluenceAttachments({
+      ...INPUT,
+      listParents,
+      cursor: first.nextCursor,
+      syncContext: context,
+    })
+    expect(first.documents.map((doc) => doc.externalId)).toEqual(['p1'])
+    expect(last.documents.map((doc) => doc.externalId)).toEqual(['p2'])
+    expect(last.listingFailures).toEqual({
+      count: 2,
+      samples: ['p1', 'p2'].map((scope) => ({
+        scope,
+        operation: 'confluence.attachments.list',
+        status: 401,
+        reasons: ['attachment_scope_mismatch'],
+      })),
+    })
+    expect(last.reconciliationSafe).toBe(false)
+    expect(context.reconciliationUnsafe).toBe(true)
+  })
+
+  /**
+   * One page whose attachments the credential cannot open must not leave every pass incomplete,
+   * which would keep the connector from ever finishing a sync. Its attachments were not listed,
+   * so the page still withholds deletion of anything it did not list.
+   */
+  it.each([403, 404])(
+    'skips a parent whose attachments answer %s without failing the listing or deleting what it did not list',
     async (status) => {
-      fetchMock.mockImplementation(async () =>
-        status === 401
-          ? Response.json({ code: 401, message: 'Unauthorized; scope does not match' }, { status })
-          : new Response(null, { status })
-      )
+      fetchMock.mockImplementation(async (input) => {
+        const parentId = new URL(String(input)).pathname.split('/').at(-2) ?? ''
+        if (parentId === 'p1') return new Response(null, { status })
+        return Response.json({ results: [file({ id: `${parentId}-file`, pageId: parentId })] })
+      })
       const listParents = vi.fn(
-        async (cursor: string | undefined): Promise<ExternalDocumentList> => ({
-          documents: [parent(cursor ? 'p2' : 'p1')],
-          hasMore: !cursor,
-          nextCursor: cursor ? undefined : 'next',
+        async (): Promise<ExternalDocumentList> => ({
+          documents: [parent('p1'), parent('p2')],
+          hasMore: false,
         })
       )
-      const first = await listConfluenceAttachments({ ...INPUT, listParents })
       const context: Record<string, unknown> = {}
-      const last = await listConfluenceAttachments({
+      const result = await listConfluenceAttachments({
         ...INPUT,
         listParents,
-        cursor: first.nextCursor,
         syncContext: context,
       })
-      expect(first.documents.map((doc) => doc.externalId)).toEqual(['p1'])
-      expect(last.documents.map((doc) => doc.externalId)).toEqual(['p2'])
-      expect(last.listingFailures).toEqual({
-        count: 2,
-        samples: ['p1', 'p2'].map((scope) => ({
-          scope,
-          operation: 'confluence.attachments.list',
-          status,
-          reasons: [status === 401 ? 'attachment_scope_mismatch' : 'attachment_access_denied'],
-        })),
-      })
-      expect(last.reconciliationSafe).toBe(false)
+      expect(result.documents.map((doc) => doc.externalId)).toEqual([
+        'p1',
+        'p2',
+        'attachment:page:p2:p2-file',
+      ])
+      expect(result.hasMore).toBe(false)
+      expect(result.listingFailures).toBeUndefined()
+      expect(result.reconciliationSafe).toBe(false)
       expect(context.reconciliationUnsafe).toBe(true)
     }
   )
 
@@ -378,6 +378,7 @@ export async function listConfluenceAttachments(
 ): Promise<ExternalDocumentList> {
   const state = decodeCursor(input.cursor, input.syncContext?.totalDocsFetched)
   const documents: ExternalDocument[] = []
+  let skippedUnreadableParent = false
   if (state.parents.length === 0 && !state.parentsDone) {
     const parentContext = { ...input.syncContext, totalDocsFetched: state.parentsListed }
     const page = await input.listParents(state.parentCursor, parentContext)
@@ -413,15 +414,30 @@ export async function listConfluenceAttachments(
         })
       }
       if (state.serverFailureStreak >= MAX_CONSECUTIVE_SERVER_FAILURES) throw listing.error
-      state.failures ??= { count: 0, samples: [] }
-      state.failures.count += 1
-      if (state.failures.samples.length < MAX_LISTING_FAILURE_SAMPLES) {
-        state.failures.samples.push({
-          scope: parent.id,
-          operation: 'confluence.attachments.list',
+      if (listing.reason === 'attachment_access_denied') {
+        /**
+         * The parent was listed a moment ago, so a 403 or 404 on its attachments is that one
+         * item's restriction, not a scope the source failed to list: skipping it leaves the pass
+         * complete. Its unlisted attachments are not evidence of deletion, so the page still
+         * marks the listing unsafe and reconciliation keeps them.
+         */
+        logger.warn('Skipping a Confluence parent whose attachments are not readable', {
+          parentId: parent.id,
+          parentType: parent.type,
           status: listing.status,
-          reasons: [listing.reason],
         })
+        skippedUnreadableParent = true
+      } else {
+        state.failures ??= { count: 0, samples: [] }
+        state.failures.count += 1
+        if (state.failures.samples.length < MAX_LISTING_FAILURE_SAMPLES) {
+          state.failures.samples.push({
+            scope: parent.id,
+            operation: 'confluence.attachments.list',
+            status: listing.status,
+            reasons: [listing.reason],
+          })
+        }
       }
       state.parents.shift()
       state.attachmentCursor = undefined
@@ -453,7 +469,8 @@ export async function listConfluenceAttachments(
     state.attachmentCursor = nextCursor
     if (!nextCursor) state.parents.shift()
   }
-  if (state.failures && input.syncContext) input.syncContext.reconciliationUnsafe = true
+  const reconciliationUnsafe = Boolean(state.failures) || skippedUnreadableParent
+  if (reconciliationUnsafe && input.syncContext) input.syncContext.reconciliationUnsafe = true
   const hasMore = state.parents.length > 0 || !state.parentsDone
   const nextCursor = hasMore ? CURSOR_PREFIX + JSON.stringify(state) : undefined
   if (nextCursor && Buffer.byteLength(nextCursor, 'utf8') > MAX_CURSOR_BYTES) {
@@ -463,7 +480,8 @@ export async function listConfluenceAttachments(
     documents,
     hasMore,
     nextCursor,
-    ...(state.failures ? { listingFailures: state.failures, reconciliationSafe: false } : {}),
+    ...(state.failures ? { listingFailures: state.failures } : {}),
+    ...(reconciliationUnsafe ? { reconciliationSafe: false } : {}),
   }
 }
 
 
@@ -185,6 +185,8 @@ function arrange(
     existingDocument?: boolean
     openMemberFeed?: boolean
     contentFresh?: boolean
+    /** A content pass that finished before this run, past the content interval. */
+    finishedPass?: { lastSyncAt: Date; lastSyncDocCount: number }
     forceContentRefresh?: boolean
     noDueMembers?: boolean
     syncIntervalMinutes?: number
@@ -211,7 +213,8 @@ function arrange(
     memberSyncStatus: 'idle',
     memberSyncConsecutiveFailures: 0,
     syncIntervalMinutes: options.syncIntervalMinutes ?? 1440,
-    lastSyncAt: options.contentFresh ? new Date() : null,
+    lastSyncAt: options.finishedPass?.lastSyncAt ?? (options.contentFresh ? new Date() : null),
+    lastSyncDocCount: options.finishedPass?.lastSyncDocCount ?? null,
     directoryCheckpoint: options.directoryCheckpoint ?? null,
     sourceConfig: { folderId: 'shared-folder', adminEmail: 'admin@example.com' },
     accessRewritePending: false,
@@ -280,7 +283,8 @@ function arrange(
         },
       ])
     }
-    queueTableRows(schemaMock.document, [{ count: 1 }])
+    if (!options.finishedPass || !options.contentIncomplete)
+      queueTableRows(schemaMock.document, [{ count: 1 }])
   }
   if (options.members && !options.noDueMembers)
     queueTableRows(schemaMock.document, [
@@ -553,6 +557,43 @@ describe('member engine with a dedicated content credential', () => {
     expect(bounded).toEqual([])
   })
 
+  /**
+   * A finished pass recorded the count, and an unfinished slice of the next pass keeps it rather
+   * than scanning the whole connector again; the count is replaced when that pass finishes.
+   */
+  it('keeps the recorded document count on an unfinished slice once a pass has finished', async () => {
+    const run = arrange({
+      contentIncomplete: true,
+      finishedPass: { lastSyncAt: new Date(Date.now() - 2 * 86_400_000), lastSyncDocCount: 7 },
+    })
+    const now = Date.now()
+    const clock = vi.spyOn(Date, 'now')
+    mocks.list.mockResolvedValue({
+      documents: Array.from({ length: 26 }, (_, i) => ({
+        ...serviceDocument,
+        externalId: `content-${i}`,
+      })),
+      hasMore: false,
+    })
+    mocks.get.mockImplementation(async (_token, _config, externalId: string) => {
+      clock.mockReturnValue(now + 35 * 60_000)
+      return { ...serviceDocument, externalId, content: 'Service content', contentDeferred: false }
+    })
+    try {
+      const result = await run()
+      expect(result.error).toBeUndefined()
+      expect(result.docsAdded).toBeGreaterThan(0)
+      expect(dbChainMockFns.values).toHaveBeenCalledWith(
+        expect.objectContaining({ status: 'partial', listedCount: null })
+      )
+      expect(
+        dbChainMockFns.set.mock.calls.some(([value]) => value && 'lastSyncDocCount' in value)
+      ).toBe(false)
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
   it('reserves time for member permissions when a slow dedicated content page has more batches', async () => {
     const run = arrange({ members: true, contentIncomplete: true })
     const now = Date.now()
 
@@ -121,7 +121,9 @@ import {
   ConnectorSyncCapacityError,
   classifyListing,
   classifySuspectListing,
+  countLiveConnectorDocuments,
   createSyncRunState,
+  keepsRecordedDocCount,
   loadPageCorpus,
   processDocOps,
   RETRY_WINDOW_DAYS,
@@ -1711,17 +1713,9 @@ async function syncDedicatedMemberContent(input: {
     run.result.listingIncomplete = true
   const contentNotice = pass.holdNotice
   /** Counted before the lease transaction: a scan of the whole connector never holds its row. */
-  const [{ count }] = await db
-    .select({ count: sql<number>`count(*)::int` })
-    .from(document)
-    .where(
-      and(
-        eq(document.connectorId, run.connectorId),
-        eq(document.userExcluded, false),
-        isNull(document.archivedAt),
-        isNull(document.deletedAt)
-      )
-    )
+  const count = keepsRecordedDocCount(pass.complete, connector)
+    ? null
+    : await countLiveConnectorDocuments(run.connectorId)
   await withMemberLease(run, async (tx) => {
     const now = new Date()
     await tx.insert(knowledgeConnectorSyncLog).values({
@@ -1746,7 +1740,7 @@ async function syncDedicatedMemberContent(input: {
           ? { lastSyncAt: new Date(pass.checkpoint.startedAt) }
           : {}),
         ...(pass.complete ? { listingCheckpoint: null } : {}),
-        lastSyncDocCount: count,
+        ...(count === null ? {} : { lastSyncDocCount: count }),
         lastSyncError: contentNotice,
         updatedAt: now,
       })
 
@@ -89,6 +89,8 @@ import {
   ConnectorDeletedException,
   ConnectorSyncCapacityError,
   checkSyncTargetPresence,
+  countLiveConnectorDocuments,
+  keepsRecordedDocCount,
   RETRY_WINDOW_DAYS,
   shouldRunIncrementalSync,
   sweepStuckDocuments,
@@ -368,22 +370,6 @@ export function isContentPassIncomplete(
   )
 }
 
-/** Live documents the connector owns: what the connector list shows as its document count. */
-async function countLiveConnectorDocuments(connectorId: string): Promise<number> {
-  const [row] = await db
-    .select({ count: sql<number>`count(*)::int` })
-    .from(document)
-    .where(
-      and(
-        eq(document.connectorId, connectorId),
-        eq(document.userExcluded, false),
-        isNull(document.archivedAt),
-        isNull(document.deletedAt)
-      )
-    )
-  return row?.count ?? 0
-}
-
 /**
  * Atomically publishes the completed log and connector terminal state.
  *
@@ -435,29 +421,19 @@ export async function completeSuccessfulSync(
    * owned count the next pass's mass-deletion guard starts from, so a tally of this run's
    * adds and deletes would drift; when it cannot be read the previous count stands, which the
    * guard already treats as a floor.
-   *
-   * Once a pass has finished, a slice that leaves the next pass unfinished keeps the count that
-   * finished pass recorded, the same pass `lastSyncAt` still names, so a large connector is not
-   * counted again on every slice of a pass whose count is replaced when it finishes. Unfinished
-   * slices never advance `lastSyncAt`, so until a pass finishes every slice is counted and a
-   * first pass shows its progress.
    */
-  const keepRecordedCount =
-    contentPass !== undefined &&
-    !contentPass.complete &&
-    lockedConnector?.lastSyncAt != null &&
-    lockedConnector.lastSyncDocCount !== null
-  const actualDocCount = keepRecordedCount
-    ? null
-    : await countLiveConnectorDocuments(connectorId).catch((error: unknown) => {
-        const diagnostic = getConnectorFailureDiagnostic(error)
-        if (diagnostic?.category !== 'database') throw error
-        logger.warn('Could not count connector documents; keeping the previous count', {
-          connectorId,
-          diagnostic,
+  const actualDocCount =
+    contentPass !== undefined && keepsRecordedDocCount(contentPass.complete, lockedConnector)
+      ? null
+      : await countLiveConnectorDocuments(connectorId).catch((error: unknown) => {
+          const diagnostic = getConnectorFailureDiagnostic(error)
+          if (diagnostic?.category !== 'database') throw error
+          logger.warn('Could not count connector documents; keeping the previous count', {
+            connectorId,
+            diagnostic,
+          })
+          return null
         })
-        return null
-      })
   try {
     return await db.transaction(async (tx) => {
       const [lockedKnowledgeBase] = await tx
 
@@ -653,6 +653,38 @@ export function resolvePreviousOwnedCount(
   return Math.max(lastSyncDocCount ?? 0, ownedDocCount)
 }
 
+/** Live documents the connector owns: what the connector list shows as its document count. */
+export async function countLiveConnectorDocuments(connectorId: string): Promise<number> {
+  const [row] = await db
+    .select({ count: sql<number>`count(*)::int` })
+    .from(document)
+    .where(
+      and(
+        eq(document.connectorId, connectorId),
+        eq(document.userExcluded, false),
+        isNull(document.archivedAt),
+        isNull(document.deletedAt)
+      )
+    )
+  return row?.count ?? 0
+}
+
+/**
+ * Whether a slice keeps the document count the connector holds instead of counting again.
+ *
+ * Once a pass has finished, a slice that leaves the next pass unfinished keeps the count that
+ * finished pass recorded, the same pass `lastSyncAt` still names, so a large connector is not
+ * counted again on every slice of a pass whose count is replaced when it finishes. Unfinished
+ * slices never advance `lastSyncAt`, so until a pass finishes every slice is counted and a first
+ * pass shows its progress.
+ */
+export function keepsRecordedDocCount(
+  passComplete: boolean,
+  connector: { lastSyncAt: Date | null; lastSyncDocCount: number | null } | null
+): boolean {
+  return !passComplete && connector?.lastSyncAt != null && connector.lastSyncDocCount != null
+}
+
 /**
  * Fraction of a connector's owned documents that a single reconciliation pass
  * may remove before the pass is held.