@@ -28,6 +28,11 @@ Only Copilot principals (`delegated` / `organization_delegated` with `serviceId:
 classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
 the workflow executor see byte-identical results.
 
+A run Chat starts executes as Chat's principal, so `executeWorkflowCore` runs every execution under
+`runWorkflowOutsideContentDelivery`, where that principal reads like any other. What the run returns
+is gated where Chat started it: run execute/resume keep inline file bytes only for admitted files
+(`withholdUnadmittedInlineFiles`), and Chat's in-app run tools strip `base64` from their result.
+
 ## The pieces
 
 - `lib/core/application/content-delivery.ts`: the primitive.
 
@@ -19,6 +19,11 @@ Only Copilot principals (`delegated` / `organization_delegated` with `serviceId:
 classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
 the workflow executor see byte-identical results.
 
+A run Chat starts executes as Chat's principal, so `executeWorkflowCore` runs every execution under
+`runWorkflowOutsideContentDelivery`, where that principal reads like any other. What the run returns
+is gated where Chat started it: run execute/resume keep inline file bytes only for admitted files
+(`withholdUnadmittedInlineFiles`), and Chat's in-app run tools strip `base64` from their result.
+
 ## The pieces
 
 - `lib/core/application/content-delivery.ts`: the primitive.
 
@@ -574,20 +574,20 @@ describe('AgentBlockHandler', () => {
       context: 'execution',
       base64: 'iVBORw0KGgo=',
     }
+    const hydrateWithBytes = () =>
+      vi.spyOn(userFileBase64, 'hydrateUserFilesWithBase64').mockImplementation(
+        async (value) =>
+          (value as (typeof file)[]).map((attachment) => ({
+            ...attachment,
+            base64: file.base64,
+          })) as typeof value
+      )
 
     it.each(['files', 'messages', 'userPrompt'] as const)(
       'replays a previous turn from %s with a fresh provider attachment',
       async (source) => {
         mockGetProviderFromModel.mockReturnValue('openai')
-        const hydrate = vi
-          .spyOn(userFileBase64, 'hydrateUserFilesWithBase64')
-          .mockImplementation(async (value) => {
-            const files = value as (typeof file)[]
-            return files.map((attachment) => ({
-              ...attachment,
-              base64: file.base64,
-            })) as typeof value
-          })
+        const hydrate = hydrateWithBytes()
         const inputs: AgentInputs = {
           model: 'gpt-4o',
           memoryType: 'conversation',
@@ -682,6 +682,127 @@ describe('AgentBlockHandler', () => {
         )
       ).toBe(false)
     })
+
+    const numbered = (index: number) => ({
+      ...file,
+      id: `file-${index}`,
+      name: `page-${index}.png`,
+      key: `execution/test-workspace/test-workflow/exec-1/page-${index}.png`,
+    })
+
+    it('replays files every turn re-attached once each, where they first appear', async () => {
+      mockGetProviderFromModel.mockReturnValue('openai')
+      const hydrate = hydrateWithBytes()
+      const attachments = Array.from({ length: 7 }, (_, index) => numbered(index))
+      queueTableRows(schemaMock.memory, [
+        {
+          secretProvenanceVersion: null,
+          data: [1, 2, 3].flatMap((turn) => [
+            { role: 'user', content: `Turn ${turn}`, files: attachments },
+            { role: 'assistant', content: `Answer ${turn}` },
+          ]),
+        },
+      ])
+      await handler.execute({ ...mockContext, executionId: 'exec-4' }, mockBlock, {
+        model: 'gpt-4o',
+        memoryType: 'conversation',
+        conversationId: 'conversation-1',
+        messages: [{ role: 'user', content: 'Turn 4' }],
+        files: attachments,
+      })
+      const sent = mockExecuteProviderRequest.mock.calls.at(-1)?.[1].messages as Message[]
+      const userTurns = sent.filter((message) => message.role === 'user')
+      expect(userTurns.map((message) => message.content)).toEqual([
+        'Turn 1',
+        'Turn 2',
+        'Turn 3',
+        'Turn 4',
+      ])
+      expect(userTurns[0].files?.map((attachment) => attachment.key)).toEqual(
+        attachments.map((attachment) => attachment.key)
+      )
+      expect(userTurns.slice(1).map((message) => message.files)).toEqual([
+        undefined,
+        undefined,
+        undefined,
+      ])
+      expect(hydrate.mock.calls.flatMap(([value]) => value as unknown[])).toHaveLength(7)
+      hydrate.mockRestore()
+    })
+
+    it('still refuses a replay of more distinct files than the memory limit', async () => {
+      mockGetProviderFromModel.mockReturnValue('openai')
+      const hydrate = hydrateWithBytes()
+      queueTableRows(schemaMock.memory, [
+        {
+          secretProvenanceVersion: null,
+          data: [0, 1, 2].map((turn) => ({
+            role: 'user',
+            content: `Turn ${turn}`,
+            files: Array.from({ length: 7 }, (_, index) => numbered(turn * 7 + index)),
+          })),
+        },
+      ])
+      await expect(
+        handler.execute({ ...mockContext, executionId: 'exec-4' }, mockBlock, {
+          model: 'gpt-4o',
+          memoryType: 'conversation',
+          conversationId: 'conversation-1',
+          messages: [{ role: 'user', content: 'Turn 3' }],
+        })
+      ).rejects.toThrow('Conversation memory exceeds 20 file attachments')
+      expect(mockExecuteProviderRequest).not.toHaveBeenCalled()
+      hydrate.mockRestore()
+    })
+
+    it('keeps a repeated file on a turn that has no text to stand on without it', async () => {
+      mockGetProviderFromModel.mockReturnValue('openai')
+      const hydrate = hydrateWithBytes()
+      queueTableRows(schemaMock.memory, [
+        {
+          secretProvenanceVersion: null,
+          data: [
+            { role: 'user', content: 'Read this', files: [file] },
+            { role: 'assistant', content: 'Read it' },
+            { role: 'user', content: '', files: [file] },
+            { role: 'assistant', content: 'Same file' },
+          ],
+        },
+      ])
+      await handler.execute({ ...mockContext, executionId: 'exec-3' }, mockBlock, {
+        model: 'gpt-4o',
+        memoryType: 'conversation',
+        conversationId: 'conversation-1',
+        messages: [{ role: 'user', content: 'And now?' }],
+      })
+      const sent = mockExecuteProviderRequest.mock.calls.at(-1)?.[1].messages as Message[]
+      const userTurns = sent.filter((message) => message.role === 'user')
+      expect(userTurns.map((message) => message.files?.length)).toEqual([1, 1, undefined])
+      hydrate.mockRestore()
+    })
+
+    it('keeps a user turn’s file when only an earlier assistant turn carried it', async () => {
+      mockGetProviderFromModel.mockReturnValue('openai')
+      const hydrate = hydrateWithBytes()
+      queueTableRows(schemaMock.memory, [
+        {
+          secretProvenanceVersion: null,
+          data: [
+            { role: 'assistant', content: 'Here is a file', files: [file] },
+            { role: 'user', content: 'Read it', files: [file] },
+          ],
+        },
+      ])
+      await handler.execute({ ...mockContext, executionId: 'exec-3' }, mockBlock, {
+        model: 'gpt-4o',
+        memoryType: 'conversation',
+        conversationId: 'conversation-1',
+        messages: [{ role: 'user', content: 'And now?' }],
+      })
+      const sent = mockExecuteProviderRequest.mock.calls.at(-1)?.[1].messages as Message[]
+      expect(sent.find((message) => message.content === 'Read it')?.files).toHaveLength(1)
+      hydrate.mockRestore()
+    })
   })
 
   describe('model fallback', () => {
 
@@ -68,6 +68,7 @@ import {
   getMemoryMessageAppendKey,
   getMemoryMessageTurnId,
   memoryService,
+  selectReplayAttachments,
 } from '@/executor/handlers/agent/memory'
 import {
   buildLoadSkillTool,
@@ -1754,22 +1755,30 @@ export class AgentBlockHandler implements BlockHandler {
 
     const inlineMaxBytes = getInlineHydrationMaxBytes(providerId)
 
+    const replayAttachments = selectReplayAttachments(messages)
+
     for (let messageIndex = 0; messageIndex < messages.length; messageIndex++) {
       const message = messages[messageIndex]
       if (!message.files?.length) {
         continue
       }
+      const files = replayAttachments[messageIndex]
+      if (files.length === 0) {
+        nextMessages[messageIndex] = omit(message, ['files'])
+        copyNativeConversationMessage(message, nextMessages[messageIndex])
+        continue
+      }
 
       const unsafeGeneratedDocumentFiles = new Set<string>()
       const groups = new Map<boolean, Array<{ file: UserFile; index: number }>>()
-      message.files.forEach((file, index) => {
+      files.forEach((file, index) => {
         const workspaceFile =
           ctx.principal?.kind === 'system' && tryInferContextFromKey(file.key) === 'workspace'
         const group = groups.get(workspaceFile) ?? []
         group.push({ file, index })
         groups.set(workspaceFile, group)
       })
-      const hydratedFiles = [...message.files]
+      const hydratedFiles = [...files]
       await Promise.all(
         [...groups.values()].map(async (group) => {
           const hydrated = await hydrateUserFilesWithBase64(
@@ -1805,7 +1814,7 @@ export class AgentBlockHandler implements BlockHandler {
       const modelSafeHydratedFiles = hydratedFiles.flatMap((file, fileIndex) => {
         if (unsafeGeneratedDocumentFiles.has(`${file.key}:${file.id}`)) return []
 
-        const sourceFile = message.files?.[fileIndex]
+        const sourceFile = files[fileIndex]
         const nameProjection = sourceFile ? projectedNameByFile.get(sourceFile) : undefined
         if (
           !nameProjection ||
 
@@ -43,7 +43,7 @@ import {
   readBoundMemorySecretProvenance,
 } from '@/lib/memory/secret-provenance'
 import type { AgentInputs, FileNameProjection, Message } from '@/executor/handlers/agent/types'
-import type { ExecutionContext } from '@/executor/types'
+import type { ExecutionContext, UserFile } from '@/executor/types'
 import {
   projectResolvedSecretModelContent,
   projectResolvedSecretModelJsonStrings,
@@ -118,6 +118,27 @@ function isOptionalMemoryStorageFailure(error: unknown): boolean {
   )
 }
 
+/**
+ * The attachments each message sends to the model. A storage key pins its bytes, so a file a user
+ * attached on several turns is sent once, where it first appears, keeping the replayed prefix
+ * stable across runs; a user turn with no text keeps its own so it is never sent empty. Only user
+ * turns are deduplicated: every provider sends their attachments, while some drop other roles'.
+ */
+export function selectReplayAttachments(messages: readonly Message[]): UserFile[][] {
+  const sent = new Set<string>()
+  return messages.map((message) => {
+    const files = message.files ?? []
+    if (message.role !== 'user') return files
+    const unsent = files.filter((file) => {
+      const identity = file.key || file.id
+      if (sent.has(identity)) return false
+      sent.add(identity)
+      return true
+    })
+    return unsent.length === 0 && !message.content?.trim() ? files : unsent
+  })
+}
+
 export class Memory {
   async fetchMemoryMessages(
     ctx: ExecutionContext,
@@ -177,7 +198,10 @@ export class Memory {
     }
 
     /** Bound historical downloads independently of text-token windows and per-file byte caps. */
-    const fileCount = messages.reduce((count, message) => count + (message.files?.length ?? 0), 0)
+    const fileCount = selectReplayAttachments(messages).reduce(
+      (count, files) => count + files.length,
+      0
+    )
     if (fileCount > MEMORY.MAX_REPLAY_FILE_REFERENCES) {
       throw new Error(
         `Conversation memory exceeds ${MEMORY.MAX_REPLAY_FILE_REFERENCES} file attachments. Use a smaller memory window.`
 
@@ -19,6 +19,7 @@ import {
   observeContentOutsideModel,
   requireAdmittedContent,
   runDeclaredContentOperation,
+  runWorkflowOutsideContentDelivery,
   trackContentDelivery,
 } from '@/lib/core/application/content-delivery'
 import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
@@ -499,6 +500,37 @@ describe('observeContentDelivery', () => {
   })
 })
 
+describe('runWorkflowOutsideContentDelivery', () => {
+  it('keeps an in-process run from consulting or accounting to the Chat request around it', async () => {
+    const { gate, batches } = recordingGate()
+    const record = await observeContentDelivery(gate, () =>
+      trackContentDelivery(async () => {
+        noteContentDeliveryOperation(SOURCED, CHAT)
+        await runWorkflowOutsideContentDelivery(() =>
+          runDeclaredContentOperation(SOURCED, CHAT, () =>
+            admitContent(CHAT, [source('tainted', 'unknown')])
+          )
+        )
+      })
+    )
+    expect(batches).toEqual([])
+    expect(record.unaccounted).toBe(true)
+  })
+
+  it('classifies again under a gate installed inside the run, and after the run returns', async () => {
+    const outer = recordingGate()
+    const inner = recordingGate()
+    await observeContentDelivery(outer.gate, async () => {
+      await runWorkflowOutsideContentDelivery(() =>
+        observeContentDelivery(inner.gate, () => admitContent(CHAT, [source('inside')]))
+      )
+      await admitContent(CHAT, [source('result')])
+    })
+    expect(inner.batches).toEqual([['inside']])
+    expect(outer.batches).toEqual([['result']])
+  })
+})
+
 describe('observeContentOutsideModel', () => {
   it('admits every item, tainted ones included, inside a gate that would refuse them', async () => {
     const { gate, batches } = recordingGate()
 
@@ -99,6 +99,8 @@ interface ContentLedger {
 
 const gates = new AsyncLocalStorage<ContentDeliveryGate>()
 const ledgers = new AsyncLocalStorage<ContentLedger>()
+/** Set inside {@link runWorkflowOutsideContentDelivery}; any gate installed within clears it. */
+const workflowRuns = new AsyncLocalStorage<true>()
 
 const MODEL_UNSAFE_CONTENT_MESSAGES: Record<ContentSourceKind, string> = {
   'workspace-file': 'File cannot be sent to a model because its secret provenance is unavailable',
@@ -155,19 +157,32 @@ class ContentDeliveryUndeclaredError extends Error {
   }
 }
 
-/** Chat's own workspace, organization, and resource delegations. */
+/**
+ * Chat's own workspace, organization, and resource delegations, outside a workflow run (see
+ * {@link runWorkflowOutsideContentDelivery}).
+ */
 export function isCopilotPrincipal(principal: Principal): boolean {
   return (
     (principal.kind === 'delegated' ||
       principal.kind === 'organization_delegated' ||
       principal.kind === 'resource_delegated') &&
-    principal.serviceId === 'copilot'
+    principal.serviceId === 'copilot' &&
+    workflowRuns.getStore() === undefined
   )
 }
 
 /** Installs the gate every item reported inside `execute` is decided by; the innermost gate wins. */
 export function observeContentDelivery<T>(gate: ContentDeliveryGate, execute: () => T): T {
-  return gates.run(gate, execute)
+  return workflowRuns.exit(() => gates.run(gate, execute))
+}
+
+/**
+ * Runs a workflow execution as any caller, even when Chat started it: its blocks read for the run,
+ * and what the run returns is gated where Chat started it. It neither consults nor accounts to a
+ * Chat request it runs in-process under; a gate installed inside it classifies again.
+ */
+export function runWorkflowOutsideContentDelivery<T>(execute: () => T): T {
+  return ledgers.exit(() => workflowRuns.run(true, execute))
 }
 
 /**
@@ -202,7 +217,7 @@ const OUTSIDE_MODEL_GATE: ContentDeliveryGate = {
  * so a tainted source still yields a derived file that carries its taint. Each use names why.
  */
 export function observeContentOutsideModel<T>(execute: () => T): T {
-  return gates.run(OUTSIDE_MODEL_GATE, execute)
+  return observeContentDelivery(OUTSIDE_MODEL_GATE, execute)
 }
 
 /**
 
@@ -85,6 +85,7 @@ export {
   redactBeforeCutting,
   requireAdmittedContent,
   runDeclaredContentOperation,
+  runWorkflowOutsideContentDelivery,
   trackContentDelivery,
   type WithheldContent,
 } from './content-delivery'