@@ -0,0 +1,46 @@
+import { createRouteContext } from '@sim/testing/helpers/http'
+import { mcpServiceMock, mcpServiceMockFns } from '@sim/testing/mocks/mcp-service.mock'
+import { NextRequest } from 'next/server'
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/utils/with-route-handler', () => ({
+  withRouteHandler: (handler: unknown) => handler,
+}))
+
+vi.mock('@/lib/mcp/middleware', () => ({
+  mcpBodyReadErrorResponse: vi.fn(() => null),
+  readMcpJsonBodyWithLimit: (request: NextRequest) => request.json(),
+  withMcpAuth:
+    () =>
+    (
+      handler: (
+        request: NextRequest,
+        context: { userId: string; workspaceId: string; requestId: string }
+      ) => Promise<Response>
+    ) =>
+    (request: NextRequest) =>
+      handler(request, { userId: 'user-1', workspaceId: 'workspace-1', requestId: 'request-1' }),
+}))
+
+vi.mock('@/lib/mcp/service', () => mcpServiceMock)
+
+import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
+import { GET } from '@/app/api/mcp/tools/discover/route'
+
+describe('GET /api/mcp/tools/discover', () => {
+  it('asks for reauthorization when the stored grant needs a fresh redirect', async () => {
+    mcpServiceMockFns.mockDiscoverServerTools.mockRejectedValueOnce(
+      new McpOauthRedirectRequired('https://auth.example.com/authorize?state=secret-state')
+    )
+
+    const response = await GET(
+      new NextRequest(
+        'http://localhost:3000/api/mcp/tools/discover?workspaceId=workspace-1&serverId=mcp-1'
+      ),
+      createRouteContext({})
+    )
+
+    expect(response.status).toBe(401)
+    expect(JSON.stringify(await response.json())).not.toContain('secret-state')
+  })
+})
@@ -10,6 +10,7 @@ import {
   readMcpJsonBodyWithLimit,
   withMcpAuth,
 } from '@/lib/mcp/middleware'
+import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
 import { mcpService } from '@/lib/mcp/service'
 import { McpOauthAuthorizationRequiredError, type McpToolDiscoveryResponse } from '@/lib/mcp/types'
 import { categorizeError, createMcpErrorResponse, createMcpSuccessResponse } from '@/lib/mcp/utils'
@@ -98,6 +99,7 @@ export const GET = withRouteHandler(
     } catch (error) {
       if (
         error instanceof McpOauthAuthorizationRequiredError ||
+        error instanceof McpOauthRedirectRequired ||
         error instanceof UnauthorizedError
       ) {
         return createMcpErrorResponse(error, 'OAuth re-authorization required', 401)
 
@@ -1,12 +1,17 @@
 import { getMothershipTaskStatusContract } from '@/lib/api/contracts/mothership-tasks'
 import {
   defineInternalJsonRoute,
+  extendInternalErrorPolicy,
+  internalErrorResponse,
   internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
 import { taskOperations } from '@/lib/mothership/tasks/application/operations'
-import { readTaskStatus } from '@/lib/mothership/tasks/application/read-status'
+import {
+  readTaskStatus,
+  TaskServiceUnavailableError,
+} from '@/lib/mothership/tasks/application/read-status'
 
 export const GET = defineInternalJsonRoute({
   contract: getMothershipTaskStatusContract,
@@ -17,7 +22,11 @@ export const GET = defineInternalJsonRoute({
     // Twenty active watches, each refreshing every ten seconds.
     config: { maxTokens: 120, refillRate: 120, refillIntervalMs: 60_000 },
   }),
-  errorPolicy: internalOrchestrationErrorPolicy,
+  errorPolicy: extendInternalErrorPolicy(internalOrchestrationErrorPolicy, (error) =>
+    error instanceof TaskServiceUnavailableError
+      ? internalErrorResponse(error.timedOut ? 504 : 503, { error: error.message })
+      : null
+  ),
   mapInput: ({ params }) => params,
   useCase: readTaskStatus,
 })
@@ -19,6 +19,7 @@ vi.mock('@/lib/mcp/application/use-cases', () => mcpUseCasesMock)
 
 import { NoWorkspaceAccessError, WorkspaceApiKeyAuthorizationError } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
 import {
   McpConnectionError,
   McpOauthAuthorizationRequiredError,
@@ -161,6 +162,19 @@ describe('/api/v2/mcp-servers/[mcpServerId]/tools', () => {
     expect(body.error.details).toEqual({ code: 'MCP_SERVER_REAUTHORIZATION_REQUIRED' })
   })
 
+  it('reports a grant that needs a fresh authorization redirect as the same 409', async () => {
+    mockDiscoverMcpServerToolsUseCase.mockRejectedValueOnce(
+      new McpOauthRedirectRequired('https://auth.example.com/authorize?state=secret-state')
+    )
+
+    const response = await GET(request(`workspaceId=${WORKSPACE_ID}`), { ...context })
+    const body = await response.json()
+
+    expect(response.status).toBe(409)
+    expect(body.error.details).toEqual({ code: 'MCP_SERVER_REAUTHORIZATION_REQUIRED' })
+    expect(JSON.stringify(body)).not.toContain('secret-state')
+  })
+
   it('does not blame the caller for an upstream protocol fault', async () => {
     mockDiscoverMcpServerToolsUseCase.mockRejectedValueOnce(
       new Error('MCP error -32602: Invalid params')
 
@@ -4,6 +4,7 @@ import { McpError as McpSdkError } from '@modelcontextprotocol/sdk/types.js'
 import { type V2McpServer, v2McpServerSchema } from '@/lib/api/contracts/v2/mcp-servers'
 import { createV2ResourceConcealmentPolicy, type V2ErrorPolicy } from '@/lib/api/server/routes'
 import { isTimeoutError } from '@/lib/core/execution-limits'
+import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
 import { projectMcpHeaders } from '@/lib/mcp/projection'
 import type { McpServerRow } from '@/lib/mcp/queries'
 import {
@@ -74,9 +75,11 @@ function unreachableServerMessage(error: unknown): string {
  * cooling-down server is a retryable 503 (`v2Error` stamps it with
  * `Retry-After`), and a server whose stored OAuth grant no longer works is a 409
  * — the registration exists but its grant no longer does, which is a state
- * conflict a human resolves by reauthorizing. Answering all of those with a bare
- * 500 would make the endpoint that completes MCP onboarding indistinguishable
- * from a Sim outage.
+ * conflict a human resolves by reauthorizing. A grant whose refresh failed
+ * surfaces as `McpOauthRedirectRequired`: the SDK fell back to the browser
+ * authorization step, which no API caller can complete. Answering all of those
+ * with a bare 500 would make the endpoint that completes MCP onboarding
+ * indistinguishable from a Sim outage.
  *
  * The reauthorization case deliberately does **not** reuse 401. On this surface
  * 401 means exactly one thing — the Sim API key is missing or invalid — and the
@@ -101,7 +104,11 @@ export const v2McpToolDiscoveryErrorPolicy = {
     const orchestrated = mcpServerResourceErrorPolicy.render(error)
     if (orchestrated) return orchestrated
 
-    if (error instanceof McpOauthAuthorizationRequiredError || error instanceof UnauthorizedError) {
+    if (
+      error instanceof McpOauthAuthorizationRequiredError ||
+      error instanceof McpOauthRedirectRequired ||
+      error instanceof UnauthorizedError
+    ) {
       return v2Error(
         'CONFLICT',
         'The MCP server must be reauthorized in Sim before its tools can be listed',
 
@@ -1,4 +1,4 @@
-import { createMockRequest } from '@sim/testing'
+import { createMockRequest, dbChainMockFns, resetDbChainMock } from '@sim/testing'
 import { createRouteContext } from '@sim/testing/helpers/http'
 import { authMockFns } from '@sim/testing/mocks/auth.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
@@ -8,19 +8,13 @@ import {
 } from '@sim/testing/mocks/workspace-context.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const hoisted = vi.hoisted(() => ({
-  record: vi.fn(),
-}))
-
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 vi.mock('@/lib/workspaces/application/context', () => workspaceContextMock)
-vi.mock('@/lib/workspaces/visits', () => ({ recordWorkspaceVisitRecord: hoisted.record }))
 
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { POST } from '@/app/api/workspaces/[id]/visit/route'
 
 const mocks = {
-  ...hoisted,
   getSession: authMockFns.mockGetSession,
   role: workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission,
   context: workspaceContextMockFns.mockResolveActiveWorkspaceApplicationContext,
@@ -30,14 +24,14 @@ const routeContext = createRouteContext({ id: 'ws-1' })
 
 describe('POST /api/workspaces/[id]/visit', () => {
   beforeEach(() => {
+    resetDbChainMock()
     mocks.getSession.mockResolvedValue({ user: { id: 'user-1' }, session: { id: 'session-1' } })
     mocks.context.mockImplementation(async (workspaceId: string) => ({
       workspaceId,
       workspaceOrganizationId: null,
       allowPersonalApiKeys: true,
     }))
     mocks.role.mockResolvedValue('read')
-    mocks.record.mockResolvedValue(undefined)
   })
 
   it('answers 404 for a workspace outside the caller reach, same as a missing one', async () => {
@@ -50,6 +44,38 @@ describe('POST /api/workspaces/[id]/visit', () => {
     expect(denied.status).toBe(404)
     expect(missing.status).toBe(404)
     expect(await denied.json()).toEqual(await missing.json())
-    expect(mocks.record).not.toHaveBeenCalled()
+    expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+  })
+
+  /**
+   * Account deletion removes the user row while a page load still carries its
+   * session, so the visit insert loses the `user_id` foreign key. The caller is
+   * no longer signed in as anyone, which is a 401, not a server fault.
+   */
+  it('answers 401 when the signed-in account is deleted before the visit lands', async () => {
+    dbChainMockFns.onConflictDoUpdate.mockRejectedValueOnce(
+      Object.assign(new Error('insert or update on table "workspace_visit" violates foreign key'), {
+        code: '23503',
+        constraint_name: 'workspace_visit_user_id_user_id_fk',
+      })
+    )
+
+    const response = await POST(createMockRequest('POST'), routeContext)
+
+    expect(response.status).toBe(401)
+    expect(await response.json()).toEqual({ error: 'Unauthorized' })
+  })
+
+  it('keeps any other insert failure a server fault', async () => {
+    dbChainMockFns.onConflictDoUpdate.mockRejectedValueOnce(
+      Object.assign(new Error('insert or update on table "workspace_visit" violates foreign key'), {
+        code: '23503',
+        constraint_name: 'workspace_visit_workspace_id_workspace_id_fk',
+      })
+    )
+
+    const response = await POST(createMockRequest('POST'), routeContext)
+
+    expect(response.status).toBe(500)
   })
 })
@@ -1,6 +1,8 @@
 import { recordWorkspaceVisitContract } from '@/lib/api/contracts/workspaces'
 import {
   defineInternalJsonRoute,
+  extendInternalErrorPolicy,
+  internalErrorResponse,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
@@ -9,6 +11,7 @@ import {
   recordWorkspaceVisit,
   workspaceVisitOperations,
 } from '@/lib/workspaces/application/record-workspace-visit'
+import { WorkspaceOwnerMissingError } from '@/lib/workspaces/policy'
 
 export const POST = defineInternalJsonRoute({
   contract: recordWorkspaceVisitContract,
@@ -17,7 +20,14 @@ export const POST = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'One idempotent upsert per workspace page load, replacing the settings write it made.',
   }),
-  errorPolicy: internalWorkspaceErrorPolicies.concealWorkspaceAuthorization,
+  errorPolicy: extendInternalErrorPolicy(
+    internalWorkspaceErrorPolicies.concealWorkspaceAuthorization,
+    // A session that outlived its deleted account answers as signed out.
+    (error) =>
+      error instanceof WorkspaceOwnerMissingError
+        ? internalErrorResponse(401, { error: 'Unauthorized' })
+        : null
+  ),
   mapInput: ({ params }) => ({ workspaceId: params.id }),
   useCase: recordWorkspaceVisit,
   present: () => ({ success: true as const }),
 
@@ -1,6 +1,6 @@
 import { UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js'
 import { dbChainMockFns, loggerMock, resetDbChainMock } from '@sim/testing'
-import { mcpOauthMock } from '@sim/testing/mocks/mcp-oauth.mock'
+import { McpOauthRedirectRequiredMock, mcpOauthMock } from '@sim/testing/mocks/mcp-oauth.mock'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -353,6 +353,31 @@ describe('McpService.discoverTools per-server caching', () => {
     expect(mockResolveEnvVars).toHaveBeenCalledTimes(1)
   })
 
+  /**
+   * A refresh that fails sends the SDK to the browser authorization step, which
+   * Sim's provider refuses by throwing. That is the same stale grant as above, so
+   * it must not negative-cache the server: the cooldown would hide the reauth prompt.
+   */
+  it('keeps a grant that needs a fresh authorization redirect soft-pending', async () => {
+    mockGetWorkspaceServersRows.mockResolvedValue([dbRow('mcp-a', 'A', { authType: 'oauth' })])
+    mockResolveEnvVars.mockRejectedValue(
+      new McpOauthRedirectRequiredMock('https://auth.example.com/authorize')
+    )
+
+    expect(await mcpService.discoverTools(USER_ID, WORKSPACE_ID)).toEqual([])
+
+    await vi.waitFor(() => {
+      expect(dbChainMockFns.set).toHaveBeenCalledWith(
+        expect.objectContaining({ connectionStatus: 'disconnected', lastError: null })
+      )
+    })
+    expect(mockCacheAdapter.set).not.toHaveBeenCalledWith(
+      `workspace:${WORKSPACE_ID}:server:mcp-a:failure`,
+      [],
+      expect.any(Number)
+    )
+  })
+
   it('retries a transient tools/list timeout and succeeds on the second attempt', async () => {
     mockGetWorkspaceServersRows.mockResolvedValue([dbRow('mcp-a', 'A')])
     mockListTools
 
@@ -24,7 +24,12 @@ import {
   validateMcpDomain,
   validateMcpServerSsrf,
 } from '@/lib/mcp/domain-check'
-import { getOrCreateOauthRow, loadPreregisteredClient, SimMcpOauthProvider } from '@/lib/mcp/oauth'
+import {
+  getOrCreateOauthRow,
+  loadPreregisteredClient,
+  McpOauthRedirectRequired,
+  SimMcpOauthProvider,
+} from '@/lib/mcp/oauth'
 import type { McpOauthCredentials } from '@/lib/mcp/oauth/coordinated-fetch'
 import { resolveMcpConfigEnvVars } from '@/lib/mcp/resolve-config'
 import {
@@ -164,6 +169,7 @@ type ServerStatusUpdate = { discoveryStartedAt?: Date } & (
 function isOauthAuthorizationError(error: unknown, authType: McpServerConfig['authType']): boolean {
   return (
     error instanceof McpOauthAuthorizationRequiredError ||
+    error instanceof McpOauthRedirectRequired ||
     (authType === 'oauth' && error instanceof UnauthorizedError)
   )
 }
 
@@ -1,4 +1,5 @@
 import { resolvePrincipalSubjectUserId } from '@sim/auth/principal'
+import { isTimeoutError } from '@/lib/core/execution-limits'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
 import { resolveOwnedChatContext } from '@/lib/mothership/chat/application/context'
@@ -11,6 +12,33 @@ import {
   taskOperations,
 } from '@/lib/mothership/tasks/application/operations'
 
+/** The task service failed to answer a status read; `timedOut` separates a slow service from a down one. */
+export class TaskServiceUnavailableError extends Error {
+  constructor(readonly timedOut: boolean) {
+    super(timedOut ? 'Task service timed out' : 'Task service is unavailable')
+    this.name = 'TaskServiceUnavailableError'
+  }
+}
+
+async function fetchTaskStatus(base: string, input: { taskId: string }) {
+  try {
+    const response = await fetchGo(`${base}/api/tasks/status`, {
+      method: 'POST',
+      headers: mothershipRequestHeaders(),
+      body: JSON.stringify(input),
+      signal: AbortSignal.timeout(10_000),
+      redirect: 'error',
+      spanName: 'copilot.tasks.status',
+    })
+    if (response.status === 404) throw new OrchestrationError('not_found', 'Task not found')
+    if (!response.ok) throw new TaskServiceUnavailableError(false)
+    return InternalTaskStatus.parse(await response.json())
+  } catch (error) {
+    if (isTimeoutError(error)) throw new TaskServiceUnavailableError(true)
+    throw error
+  }
+}
+
 export const readTaskStatus = defineAuthorizedChatUseCase({
   operation: taskOperations.readStatus,
   organizationOperation: organizationTaskOperations.readStatus,
@@ -24,17 +52,7 @@ export const readTaskStatus = defineAuthorizedChatUseCase({
     const userId = resolvePrincipalSubjectUserId(principal)
     if (!userId) throw new OrchestrationError('forbidden', 'A user is required')
     const base = await getMothershipBaseURL({ userId })
-    const response = await fetchGo(`${base}/api/tasks/status`, {
-      method: 'POST',
-      headers: mothershipRequestHeaders(),
-      body: JSON.stringify(input),
-      signal: AbortSignal.timeout(10_000),
-      redirect: 'error',
-      spanName: 'copilot.tasks.status',
-    })
-    if (response.status === 404) throw new OrchestrationError('not_found', 'Task not found')
-    if (!response.ok) throw new Error('Task service is unavailable')
-    const task = InternalTaskStatus.parse(await response.json())
+    const task = await fetchTaskStatus(base, input)
     if (task.taskId !== input.taskId) throw new Error('Task service returned an unrelated task')
     return { ...(await resolveOwnedChatContext(principal, task.chatId)), task }
   },