@@ -37,8 +37,13 @@ the workflow executor see byte-identical results.
     does not undo the write: audit and effects run, then the operation answers with the refusal.
     Settled tool results use the same deferral, but do not claim that a mutation was saved.
   - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
-    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
-    redaction reaches: binary, base64, archives, images, public links).
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
 - Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
   into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
   them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
 
@@ -28,8 +28,13 @@ the workflow executor see byte-identical results.
     does not undo the write: audit and effects run, then the operation answers with the refusal.
     Settled tool results use the same deferral, but do not claim that a mutation was saved.
   - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
-    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
-    redaction reaches: binary, base64, archives, images, public links).
+    may appear), `{ derived: value }` (only entries occurring in `value`), `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links), or `'excerpt'` (text already
+    cut before admission, where a secret fragment cannot be redacted). Both gates withhold an
+    excerpt with known secret entries; raw opaque bytes may still enter the workbench with history.
+  - `redactBeforeCutting` projects complete text before selecting a line window. The session gate
+    creates the existing redactor from the operation's bounded evidence only when a cut needs it;
+    ordinary byte reads do not decrypt a second time or reload history.
 - Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
   into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
   them into the workbench history. Neither admits `unknown`, with one exception: the CLI's direct
 
@@ -23,9 +23,10 @@ export type ContentSourceKind =
 /**
  * How an item's content leaves the use case. `complete` is text in which any of its secrets may
  * appear; `derived` is text built from part of it, so only secrets occurring in `value` count;
- * `opaque` is bytes no text redaction reaches — binary, base64, archives, images, public links.
+ * `opaque` is bytes no text redaction reaches — binary, base64, archives, images, public links;
+ * `excerpt` is text already cut before admission, so a secret fragment cannot be redacted.
  */
-export type ContentView = 'complete' | 'opaque' | { derived: unknown }
+export type ContentView = 'complete' | 'opaque' | 'excerpt' | { derived: unknown }
 
 /** One stored item or tool result whose content a use case is about to return. */
 export interface ContentSource {
@@ -43,10 +44,13 @@ export interface ContentSource {
 export interface ContentDeliveryGate {
   admit(sources: readonly ContentSource[]): Promise<readonly boolean[]>
   /**
-   * The text as this surface's egress will show it, or `undefined` when it cannot be shown. A gate
-   * whose surface redacts (Chat's registry) implements it; see {@link redactBeforeCutting}.
+   * Redacts text before cutting, or returns `undefined` when it cannot be shown. The current
+   * operation's bounded evidence lets a surface create a redactor only when a cut needs one.
    */
-  project?(text: string): string | undefined
+  project?(
+    text: string,
+    provenance?: ContentProvenance
+  ): string | undefined | Promise<string | undefined>
 }
 
 /**
@@ -149,17 +153,17 @@ export function observeContentDelivery<T>(gate: ContentDeliveryGate, execute: ()
 /**
  * Text a use case is about to cut (a line window, a clip), redacted first by the surface's gate.
  * Egress redacts whole secrets only, so a cut through one would leave a fragment it cannot
- * recognize. Other callers, and surfaces that do not redact, get the text unchanged.
+ * recognize. Other callers and explicit outside-model reads get the text unchanged.
  */
-export function redactBeforeCutting(
+export async function redactBeforeCutting(
   principal: Principal | undefined,
   text: string,
   kind: ContentSourceKind
-): string {
+): Promise<string> {
   if (principal && !isCopilotPrincipal(principal)) return text
   const project = gates.getStore()?.project
   if (!project) return text
-  const projected = project(text)
+  const projected = await project(text, ledgers.getStore()?.admitted[0])
   if (projected === undefined) throw new ContentRefusedError(kind)
   return projected
 }
 
@@ -1,10 +1,10 @@
 import { execFile } from 'node:child_process'
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
 import { db } from '@sim/db'
-import { auditLog, organization, user, workspace } from '@sim/db/schema'
+import { auditLog, organization, user, workspace, workspaceFiles } from '@sim/db/schema'
 import { deleteWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { toolsMock, toolsMockFns } from '@sim/testing/mocks/tools.mock'
 import { generateId } from '@sim/utils/id'
@@ -29,6 +29,7 @@ import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-deleg
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { executeFunctionExecute } from '@/lib/mothership/tools/handlers/function-execute'
 import { compileDoc } from '@/lib/mothership/tools/server/files/doc-compile'
+import { compileDocForWrite } from '@/lib/mothership/tools/server/files/workspace-file'
 import {
   updateWorkspaceFileContent,
   uploadWorkspaceFile,
@@ -179,6 +180,111 @@ describe('Chat admits the file revision used by a sandbox', () => {
     expect(projected.value).toContain('{{BROKER_TOKEN}}')
   }, 60_000)
 
+  it('admits broker inputs during legacy document-write validation before returning compiler errors', async () => {
+    const principal = createCopilotChatFilePrincipal({
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      chatId,
+    })
+    const validate = (source: string, trace: ResolvedSecretTraceRegistry) =>
+      observeContentDelivery(
+        createRegistryContentGate({
+          registry: trace,
+          workspaceId: ids.workspaceId,
+          actorUserId: ids.aliceId,
+        }),
+        () =>
+          compileDocForWrite({
+            source,
+            fileName: 'write-validation.pdf',
+            workspaceId: ids.workspaceId,
+            principal,
+            ownerKey: `user:${ids.aliceId}`,
+            fallbackMime: 'application/pdf',
+          })
+      )
+
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from('unverified input'),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: { mode: 'replace', provenance: { status: 'unknown' } },
+      }
+    )
+    const refused = await validate(
+      `const id = ${JSON.stringify(fileId)}; await getFileBase64(id); pdf.addPage();`,
+      registry()
+    )
+    expect.soft(refused).toMatchObject({ ok: false })
+    if (!refused.ok) expect(refused.message).toMatch(/provenance|read safely/i)
+
+    await updateWorkspaceFileContent(
+      ids.workspaceId,
+      fileId,
+      ids.aliceId,
+      Buffer.from(secret),
+      undefined,
+      {
+        version: { source: 'api', authorUserId: ids.aliceId },
+        secretProvenancePolicy: {
+          mode: 'replace',
+          provenance: {
+            status: 'exact',
+            entries: [
+              {
+                name: 'BROKER_TOKEN',
+                sourceUserId: ids.aliceId,
+                sourceWorkspaceId: ids.workspaceId,
+                encryptedValue: (await encryptSecret(secret)).encrypted,
+              },
+            ],
+          },
+        },
+      }
+    )
+    const trace = registry()
+    const failed = await validate(
+      `const id = ${JSON.stringify(fileId)}; const uri = await getFileBase64(id); throw new Error(Buffer.from(uri.split(',')[1], 'base64').toString());`,
+      trace
+    )
+    expect(failed.ok).toBe(false)
+    if (failed.ok) throw new Error('Expected the document source to fail')
+    expect(failed.message).toContain(secret)
+    const projected = projectResolvedSecretModelContent(failed.message, trace)
+    if (!projected.safe) throw new Error('Expected a safely projected compiler error')
+    expect(projected.value).not.toContain(secret)
+    expect(projected.value).toContain('{{BROKER_TOKEN}}')
+  }, 60_000)
+
+  it('keeps successful legacy dynamic-input documents readable after their first compile', async () => {
+    const references = Array.from({ length: 501 }, (_, index) => ({
+      id: `wf_${generateId()}`,
+      key: `workspace/${ids.workspaceId}/cache-reference-${generateId()}.txt`,
+      originalName: `reference-${index}.txt`,
+      userId: ids.aliceId,
+      workspaceId: ids.workspaceId,
+      context: 'workspace',
+      contentType: 'text/plain',
+      sizeBytes: 6,
+    }))
+    await db.insert(workspaceFiles).values(references)
+    await mkdir(join(storage.root, 'workspace', ids.workspaceId), { recursive: true })
+    for (const reference of references) {
+      await writeFile(join(storage.root, reference.key), 'public')
+    }
+    const source = `const ids = ${JSON.stringify(references.map((file) => file.id))}; for (const id of ids) await getFileBase64(id); pdf.addPage().drawText('compiled all references');`
+    const first = await compile(source, registry())
+    expect(first.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(first.contributingFiles).toHaveLength(references.length)
+    const second = await compile(source, registry())
+    expect(second.buffer.subarray(0, 4).toString()).toBe('%PDF')
+    expect(second.contributingFiles).toHaveLength(references.length)
+  }, 120_000)
+
   it('does not run code with a stale local file after refusing its requested replacement', async () => {
     await updateWorkspaceFileContent(
       ids.workspaceId,
 
@@ -273,6 +273,66 @@ describe('knowledge content delivery', () => {
     }
   })
 
+  it('streams chunk pages without reloading the tracked inline original for each page', async () => {
+    const content = 'inline original content '.repeat(4096)
+    const doc = await seedDocument({ content, provenance: { status: 'exact', entries: [] } })
+    await db.insert(embedding).values(
+      Array.from({ length: 100 }, (_, index) => {
+        const text = `public exported chunk ${index + 1}`
+        return {
+          id: generateId(),
+          documentId: doc.id,
+          knowledgeBaseId: ids.knowledgeBaseId,
+          chunkIndex: index + 1,
+          ...embeddingVectorValues(1536, [1, ...Array<number>(1535).fill(0)]),
+          chunkHash: sha256Hex(text),
+          content: text,
+          contentLength: text.length,
+          tokenCount: 4,
+          startOffset: 0,
+          endOffset: text.length,
+          tag1: 'public',
+        }
+      })
+    )
+    const bundle = await inChat(() =>
+      exportKnowledgeBase.execute({
+        principal,
+        input: { knowledgeBaseId: ids.knowledgeBaseId, vectors: true },
+      })
+    )
+    const originalBytes = Buffer.byteLength(
+      `data:text/plain;base64,${Buffer.from(content).toString('base64')}`
+    )
+    let loadedOriginalBytes = 0
+    const execute = PostgresJsPreparedQuery.prototype.execute
+    const measure = vi
+      .spyOn(PostgresJsPreparedQuery.prototype, 'execute')
+      .mockImplementation(async function (this: typeof PostgresJsPreparedQuery.prototype, values) {
+        const rows = await execute.call(this, values)
+        if (Array.isArray(rows)) {
+          for (const row of rows) {
+            if (!isRecordLike(row)) continue
+            const value = row.fileUrl
+            if (typeof value === 'string' && value.startsWith('data:'))
+              loadedOriginalBytes += Buffer.byteLength(value)
+          }
+        }
+        return rows
+      })
+    try {
+      const exported: string[] = []
+      for await (const chunk of bundle.chunks(doc.id)) exported.push(chunk.content)
+      expect(exported).toHaveLength(101)
+      expect(exported[0]).toBe(content)
+      expect(exported.at(-1)).toBe('public exported chunk 100')
+      expect(loadedOriginalBytes).toBeGreaterThan(0)
+      expect(loadedOriginalBytes).toBeLessThanOrEqual(originalBytes)
+    } finally {
+      measure.mockRestore()
+    }
+  })
+
   it('keeps stored search totals and continuation while withholding only unsafe documents', async () => {
     await seedDocument({ name: 'page-a.txt' })
     await seedDocument({ name: 'page-b.txt', provenance: { status: 'unknown' } })