@@ -8,6 +8,7 @@ description: Build, change, consolidate, remove, or review Sim Platform UI in ap
 Start in the Sim checkout containing the requested product work. Read the [Platform contract](../../../apps/sim/platform/AGENTS.md) and [component ownership map](../../../apps/sim/platform/docs/component-ownership.md). These versioned files carry the current rules into a fresh chat. Use the [Platform README](../../../apps/sim/platform/README.md) for the local routes, fixture states, generators, and verification commands.
 
 1. **Establish scope on the real route.** Identify the product entry, interaction, phase, and affected consumers. When rebuilding an existing workflow, trace the old navigation target, its access gate, and the actions reachable by that viewer. Use that evidence to decide which controls belong on the new page before consulting the broader API or provider catalog. Phase 1 owns foundations and the library. Phase 2 owns working UI and transient interaction state, with examples supplied through the server fixture flag. Phase 3 connects real data and operations. Reuse the same renderer in the browser and Sim Desktop. Read the installed Next guides for the file structure or framework behavior you are changing.
+   For organization Settings, inventory the old sidebar in order, its viewer/deployment gates and every action reachable from each section. Map old header buttons to the row or section they act on. Verify the same destination and drilldown on the fixture and authenticated routes; keep real writes outside fixture sessions.
 2. **Resolve design intent.** For Paper-backed work, use `$sim-paper-design` to locate the live Shared or Platform master and the product states that use it. Exclude Marcus. Preserve the key and theme roles. Treat artboard sizes as reference measurements. For code-first changes, follow the latest explicit product direction and inspect the rendered route. Identify any source you could not verify. Update the Paper canvas when the request includes Paper changes.
 3. **Choose or change the owner.** Start with the behavior. An action, navigation row, value picker, or disclosure has an existing keyboard and pointer contract. Different interactions may share visual roles while retaining different semantics. Use the existing family and named props for a change in size, intent, icon, or content. Put unique anatomy and its CSS beside the route component. Keep page files free of styling. Only EMCN owns the appearance of its controls. Use Base UI there for complex keyboard, floating, and dismissal behavior.
 4. **Trace the full change.** On a second independent feature use, promote the original implementation and migrate both callers. For consolidation, compare semantics, map every consumer to its replacement, then remove the obsolete implementation, export, variant styles, and unused registrations. For deletion, also check menus, preferences, fixture data, workbench references, and tests that existed only for the removed feature. Preserve unrelated consumers and historical Paper evidence. A new variant needs a reachable product use. Edit the source or compiler for generated foundations and recipes.
 
@@ -2,17 +2,16 @@ import {
   ACCOUNT_SETTINGS_ITEMS,
   type AccountSettingsSection,
   getSettingsSectionMeta,
-  isOrganizationSettingsSectionAvailable,
   ORGANIZATION_SETTINGS_GROUPS,
   ORGANIZATION_SETTINGS_ITEMS,
   type OrganizationSettingsFeatures,
   type OrganizationSettingsSection,
   parseSettingsPathSection,
-  resolveOrganizationSectionAccess,
   type SettingsNavigationItem,
   toSettingsHeaderMeta,
 } from '@/components/settings/navigation'
 import type { SettingsHeaderMeta } from '@/components/settings/settings-header'
+import { organizationSupportsSettingsSection } from '@/lib/settings/section-availability'
 
 /**
  * A section on the organization surface's settings, tagged with the plane that
@@ -84,18 +83,8 @@ export function organizationSettingsNavigation(
   features: OrganizationSettingsFeatures,
   availability: { connectedAccounts: boolean; search: boolean; knowledgeGraphs?: boolean }
 ) {
-  return ORGANIZATION_SETTINGS_ITEMS.filter(
-    (item) =>
-      (item.id !== 'knowledge-graphs' || availability.knowledgeGraphs === true) &&
-      (item.id !== 'connected-accounts' || availability.connectedAccounts) &&
-      ((item.id !== 'search-mcp' && item.id !== 'search-slack' && item.id !== 'integrations') ||
-        availability.search) &&
-      resolveOrganizationSectionAccess({
-        section: item.id,
-        isTargetOrganizationMember: true,
-        isTargetOrganizationAdmin: isAdmin,
-      }) !== 'unavailable' &&
-      isOrganizationSettingsSectionAvailable(item.id, features)
+  return ORGANIZATION_SETTINGS_ITEMS.filter((item) =>
+    organizationSupportsSettingsSection(item.id, features, availability, isAdmin)
   )
 }
 
 
@@ -32,6 +32,10 @@ import { CodeIcon, McpIcon, SlackIcon } from '@/components/icons'
 import type { SettingsHeaderMeta } from '@/components/settings/settings-header'
 import type { DeploymentFeatures, DeploymentShape } from '@/lib/api/contracts/workspaces'
 import { organizationRoutes } from '@/lib/navigation/paths'
+import {
+  organizationMemberSectionAccess,
+  organizationPlanAllowsSettingsSection,
+} from '@/lib/settings/section-availability'
 
 export type SettingsPlane = 'account' | 'selfhost' | 'workspace'
 
@@ -1038,11 +1042,7 @@ export function resolveOrganizationSectionAccess({
   isTargetOrganizationAdmin,
 }: ResolveOrganizationSectionAccessOptions): OrganizationSectionAccess {
   if (!isTargetOrganizationMember) return 'unavailable'
-  if (section === 'search-mcp' || section === 'recently-deleted' || section === 'knowledge-graphs')
-    return 'view'
-  if (section === 'members' || section === 'requests')
-    return isTargetOrganizationAdmin ? 'manage' : 'view'
-  return isTargetOrganizationAdmin ? 'manage' : 'unavailable'
+  return organizationMemberSectionAccess(section, isTargetOrganizationAdmin)
 }
 
 export interface OrganizationSettingsFeatures {
@@ -1084,35 +1084,7 @@ export function getOrganizationSettingsFeatures(
   }
 }
 
-/**
- * Applies deployment and target-organization plan gates without consulting the
- * viewer's active organization.
- */
-export function isOrganizationSettingsSectionAvailable(
-  section: OrganizationSettingsSection,
-  features: OrganizationSettingsFeatures
-): boolean {
-  if (
-    section === 'members' ||
-    section === 'search-mcp' ||
-    section === 'knowledge-graphs' ||
-    section === 'recently-deleted' ||
-    section === 'requests'
-  )
-    return true
-  if (section === 'billing') return features.billingEnabled
-  /* Sim Search itself is enterprise on the hosted product; self-hosted gates it by flag, not by section. */
-  if (section === 'integrations' || section === 'search-slack')
-    return !features.hosted || features.hasEnterprisePlan
-  /**
-   * Access Control follows governance rather than the plan gate: its restrictions keep applying
-   * through a failing payment, so hiding the page that edits them would leave an organization
-   * governed by rules it cannot see or loosen until the invoice clears.
-   */
-  if (section === 'access-control' && features.hosted) return features.governanceActive
-  if (features.hosted) return features.hasEnterprisePlan
-  return features.selfHosted[section] ?? false
-}
+export const isOrganizationSettingsSectionAvailable = organizationPlanAllowsSettingsSection
 
 export interface WorkspacePermissionConfig {
   hideSecretsTab?: boolean
 
@@ -0,0 +1,54 @@
+import type { PermissionGroupEditorCatalog } from '@/lib/api/contracts/permission-groups'
+import type { BlockConfig } from '@/blocks/types'
+import { KNOWLEDGE_CONNECTOR_OPTIONS } from '@/ee/access-control/lib/editor-registry'
+import {
+  DYNAMIC_MODEL_PROVIDERS,
+  getStaticProviderModels,
+  NAMESPACED_MODEL_PROVIDERS,
+  PROVIDER_DEFINITIONS,
+} from '@/providers/models'
+import { getAllProviderIds } from '@/providers/utils'
+import { getToolMetadata } from '@/tools/metadata'
+
+/** The same editor options for a viewer's visible block universe and for the isolated design fixture. */
+export function projectPermissionGroupCatalog(
+  universe: BlockConfig[]
+): PermissionGroupEditorCatalog {
+  const staticModelIds = (providerId: string) =>
+    new Set(getStaticProviderModels(providerId).map((model) => model.id))
+
+  return {
+    blocks: universe.map((block) => ({
+      type: block.type,
+      name: block.name,
+      description: block.description,
+      category: block.category,
+      hidden: Boolean(block.hideFromToolbar),
+      sourceWorkspaceName: block.sourceWorkspaceName ?? null,
+      tools: (block.tools?.access ?? []).map((id) => ({
+        id,
+        label: getToolMetadata(id)?.name ?? id,
+      })),
+    })),
+    providerIds: getAllProviderIds(),
+    dynamicProviderIds: [...DYNAMIC_MODEL_PROVIDERS],
+    providers: Object.entries(PROVIDER_DEFINITIONS).map(([id, definition]) => {
+      const fromStaticCatalog = staticModelIds(id)
+      return {
+        id,
+        name: definition.name,
+        namespaced: NAMESPACED_MODEL_PROVIDERS.has(id),
+        modelPatterns: (definition.modelPatterns ?? []).map(({ source, flags }) => ({
+          source,
+          flags,
+        })),
+        models: definition.models.map((model) => ({
+          id: model.id,
+          inStaticCatalog: fromStaticCatalog.has(model.id),
+          sunset: model.sunset?.status ?? null,
+        })),
+      }
+    }),
+    knowledgeConnectors: KNOWLEDGE_CONNECTOR_OPTIONS,
+  }
+}
@@ -6,19 +6,8 @@ import {
 } from '@/lib/workflows/custom-blocks/operations'
 import { withCustomBlockOverlay } from '@/blocks/custom/server-overlay'
 import { withBlockVisibility } from '@/blocks/visibility/server-context'
-import {
-  getAccessControlBlockUniverse,
-  KNOWLEDGE_CONNECTOR_OPTIONS,
-} from '@/ee/access-control/lib/editor-registry'
-import {
-  DYNAMIC_MODEL_PROVIDERS,
-  getStaticProviderModels,
-  NAMESPACED_MODEL_PROVIDERS,
-  PROVIDER_DEFINITIONS,
-} from '@/providers/models'
-import { getAllProviderIds } from '@/providers/utils'
-import { getToolMetadata } from '@/tools/metadata'
-
+import { projectPermissionGroupCatalog } from '@/ee/access-control/lib/editor-catalog-projection'
+import { getAccessControlBlockUniverse } from '@/ee/access-control/lib/editor-registry'
 /**
  * What the permission group editor needs from the block and provider registries, for a surface that
  * does not bundle them.
@@ -40,41 +29,5 @@ export async function buildPermissionGroupEditorCatalog(context: {
   const universe = await withBlockVisibility(visibility, () =>
     withCustomBlockOverlay(customBlockRows, async () => getAccessControlBlockUniverse())
   )
-  const staticModelIds = (providerId: string) =>
-    new Set(getStaticProviderModels(providerId).map((model) => model.id))
-
-  return {
-    blocks: universe.map((block) => ({
-      type: block.type,
-      name: block.name,
-      description: block.description,
-      category: block.category,
-      hidden: Boolean(block.hideFromToolbar),
-      sourceWorkspaceName: block.sourceWorkspaceName ?? null,
-      tools: (block.tools?.access ?? []).map((id) => ({
-        id,
-        label: getToolMetadata(id)?.name ?? id,
-      })),
-    })),
-    providerIds: getAllProviderIds(),
-    dynamicProviderIds: [...DYNAMIC_MODEL_PROVIDERS],
-    providers: Object.entries(PROVIDER_DEFINITIONS).map(([id, definition]) => {
-      const fromStaticCatalog = staticModelIds(id)
-      return {
-        id,
-        name: definition.name,
-        namespaced: NAMESPACED_MODEL_PROVIDERS.has(id),
-        modelPatterns: (definition.modelPatterns ?? []).map(({ source, flags }) => ({
-          source,
-          flags,
-        })),
-        models: definition.models.map((model) => ({
-          id: model.id,
-          inStaticCatalog: fromStaticCatalog.has(model.id),
-          sunset: model.sunset?.status ?? null,
-        })),
-      }
-    }),
-    knowledgeConnectors: KNOWLEDGE_CONNECTOR_OPTIONS,
-  }
+  return projectPermissionGroupCatalog(universe)
 }
@@ -44,12 +44,12 @@ export async function refreshGeneralSettings(queryClient: QueryClient): Promise<
  * Hook to fetch general settings.
  * TanStack Query is now the single source of truth for general settings.
  */
-export function useGeneralSettings() {
+export function useGeneralSettings({ persistTheme = true }: { persistTheme?: boolean } = {}) {
   const query = useQuery(generalSettingsQuery)
 
   useEffect(() => {
-    if (query.data?.theme) syncThemeToNextThemes(query.data.theme)
-  }, [query.data?.theme])
+    if (persistTheme && query.data?.theme) syncThemeToNextThemes(query.data.theme)
+  }, [persistTheme, query.data?.theme])
 
   return query
 }
@@ -152,7 +152,7 @@ type UpdateSettingParams = {
   }
 }[keyof GeneralSettings]
 
-export function useUpdateGeneralSetting() {
+export function useUpdateGeneralSetting({ persistTheme = true }: { persistTheme?: boolean } = {}) {
   const queryClient = useQueryClient()
 
   return useMutation({
@@ -174,7 +174,7 @@ export function useUpdateGeneralSetting() {
 
         queryClient.setQueryData<GeneralSettings>(generalSettingsKeys.settings(), newSettings)
 
-        if (key === 'theme') {
+        if (persistTheme && key === 'theme') {
           syncThemeToNextThemes(value as GeneralSettings['theme'])
         }
       }
@@ -184,7 +184,7 @@ export function useUpdateGeneralSetting() {
     onError: (err, _variables, context) => {
       if (context?.previousSettings) {
         queryClient.setQueryData(generalSettingsKeys.settings(), context.previousSettings)
-        syncThemeToNextThemes(context.previousSettings.theme)
+        if (persistTheme) syncThemeToNextThemes(context.previousSettings.theme)
       }
       logger.error('Failed to update setting:', err)
     },
 
@@ -13,6 +13,7 @@ interface UseProfilePictureUploadProps {
   currentImage?: string | null
   context?: 'profile-pictures' | 'workspace-logos'
   workspaceId?: string
+  uploadWorkspaceLogo?: (file: File) => Promise<string>
 }
 
 /**
@@ -25,6 +26,7 @@ export function useProfilePictureUpload({
   currentImage,
   context = 'profile-pictures',
   workspaceId,
+  uploadWorkspaceLogo,
 }: UseProfilePictureUploadProps = {}) {
   const previewRef = useRef<string | null>(null)
   const fileInputRef = useRef<HTMLInputElement>(null)
@@ -67,8 +69,9 @@ export function useProfilePictureUpload({
     async (file: File): Promise<string> => {
       if (context === 'workspace-logos') {
         if (!workspaceId) {
-          throw new Error('workspaceId is required for workspace logo upload')
+          throw new Error('A workspace in this organization is required to upload branding images.')
         }
+        if (uploadWorkspaceLogo) return uploadWorkspaceLogo(file)
         const result = await uploadInternalFileSession({
           purpose: 'workspace_logo',
           workspaceId,
@@ -85,7 +88,7 @@ export function useProfilePictureUpload({
       logger.info(`${context} uploaded successfully: ${result.path}`)
       return result.path
     },
-    [context, workspaceId]
+    [context, workspaceId, uploadWorkspaceLogo]
   )
 
   const processFile = useCallback(
@@ -154,16 +157,14 @@ export function useProfilePictureUpload({
   }, [])
 
   /**
-   * Restore the preview to the stored image (`currentImage`) — for a form discard
-   * that should revert an unsaved pick/removal without clearing the saved image.
-   * Unlike {@link handleRemove}, this does not emit `onUpload(null)`.
+   * Restore a saved preview after discarding a draft. Defaults to the current image.
    */
-  const reset = useCallback(() => {
+  const reset = useCallback((savedImage = currentImageRef.current) => {
     if (previewRef.current) {
       URL.revokeObjectURL(previewRef.current)
       previewRef.current = null
     }
-    setPreviewUrl(currentImageRef.current || null)
+    setPreviewUrl(savedImage || null)
     setFileName(null)
     if (fileInputRef.current) {
       fileInputRef.current.value = ''
 
@@ -8,7 +8,11 @@ import type { TimeRange } from '@/stores/logs/filters/types'
  * @param startDate - Optional start date (YYYY-MM-DD) for custom range
  * @returns Date object for the start of the range, or null for 'All time'
  */
-export function getStartDateFromTimeRange(timeRange: TimeRange, startDate?: string): Date | null {
+export function getStartDateFromTimeRange(
+  timeRange: TimeRange,
+  startDate?: string,
+  referenceTime = Date.now()
+): Date | null {
   if (timeRange === 'All time') return null
 
   if (timeRange === 'Custom range') {
@@ -20,7 +24,7 @@ export function getStartDateFromTimeRange(timeRange: TimeRange, startDate?: stri
     return null
   }
 
-  const now = new Date()
+  const now = new Date(referenceTime)
 
   switch (timeRange) {
     case 'Past 30 minutes':