@@ -118,6 +118,8 @@ Redaction applies to text strings at the configured workflow stages. It does not
 
 If log redaction fails, affected strings are replaced with `[REDACTION_FAILED]` rather than stored unmasked. Failure at Workflow input or Block outputs stops the run instead of passing unredacted values downstream.
 
+Base64-encoded file content, such as a `data:` URL or a long base64 string, can't be checked for PII as text. In stored logs it is replaced with `[BINARY_CONTENT_REDACTED]`. At Workflow input and Block outputs it passes through unchanged, so later blocks can still read the file. **Run from block** and re-running with a previous run's input read that run's log, so they see the marker in place of that content, the same way they see masked PII.
+
 ## Self-hosted setup
 
 ### Enable cleanup and schedule it
 
@@ -184,6 +184,7 @@ def build_analyzer() -> AnalyzerEngine:
 anonymizer: AnonymizerEngine
 NER_ENTITIES: frozenset
 _BLANK_ARTIFACTS: dict
+_NLP_MAX_LENGTH: dict
 
 # Every entity the spaCy NER recognizers can actually produce. A request touching
 # any of these must run spaCy; a request naming only non-NER (regex/checksum)
@@ -227,6 +228,32 @@ def _regex_only(entities: list[str] | None, score_threshold: float | None) -> bo
     )
 
 
+def _require_nlp_length(
+    texts: list[str],
+    language: str,
+    entities: list[str] | None,
+    score_threshold: float | None,
+) -> None:
+    """Refuse, as a 422, any text longer than the language model's spaCy
+    `max_length` when the request runs the NLP pass. spaCy raises ValueError E088
+    for such a text, which FastAPI answers as an opaque 500 that callers retry as
+    a transient failure; the same text fails the same way every time, so callers
+    must split it rather than resend it. Regex-only requests skip spaCy and are
+    not limited."""
+    if _regex_only(entities, score_threshold):
+        return
+    limit = _NLP_MAX_LENGTH.get(language)
+    if limit is None:
+        return
+    for index, text in enumerate(texts):
+        if len(text) > limit:
+            raise HTTPException(
+                status_code=422,
+                detail=f"Text {index} has {len(text)} characters; NER accepts at most "
+                f"{limit} per text. Split it before sending.",
+            )
+
+
 def _analyze_one(
     text: str,
     language: str,
@@ -235,6 +262,7 @@ def _analyze_one(
     return_decision_process: bool = False,
     ad_hoc_recognizers: list[PatternRecognizer] | None = None,
 ):
+    _require_nlp_length([text], language, entities, score_threshold)
     # Regex-only requests reuse a blank NlpArtifacts to skip the spaCy NLP pass;
     # otherwise analyze() computes artifacts (runs spaCy) as usual. Custom-pattern
     # recognizers are regex-based, so they run fine against the blank artifacts.
@@ -265,6 +293,7 @@ def _analyze_many(
     ad_hoc_recognizers: list[PatternRecognizer] | None = None,
 ):
     """Analyze many texts, skipping the spaCy pass for regex-only requests."""
+    _require_nlp_length(texts, language, entities, score_threshold)
     if _regex_only(entities, score_threshold):
         blank = _BLANK_ARTIFACTS.get(language)
         return [
@@ -292,7 +321,7 @@ def _analyze_many(
 
 @asynccontextmanager
 async def lifespan(_app: FastAPI) -> AsyncIterator[None]:
-    global analyzer, batch_analyzer, anonymizer, NER_ENTITIES, _BLANK_ARTIFACTS
+    global analyzer, batch_analyzer, anonymizer, NER_ENTITIES, _BLANK_ARTIFACTS, _NLP_MAX_LENGTH
     logger.info("building analyzer (spacy)")
     analyzer = build_analyzer()
     batch_analyzer = BatchAnalyzerEngine(analyzer_engine=analyzer)
@@ -319,6 +348,10 @@ async def lifespan(_app: FastAPI) -> AsyncIterator[None]:
         language: analyzer.nlp_engine.process_text("", language)
         for language in SUPPORTED_LANGUAGES
     }
+    _NLP_MAX_LENGTH = {
+        language: nlp.max_length
+        for language, nlp in getattr(analyzer.nlp_engine, "nlp", {}).items()
+    }
     yield
 
 
 
@@ -1,6 +1,7 @@
 import { hybridAuthMockFns } from '@sim/testing/mocks/hybrid-auth.mock'
 import { createMockRequest } from '@sim/testing/mocks/request.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { PII_MAX_TEXT_CHARS } from '@/lib/guardrails/pii-batching'
 import { POST } from '@/app/api/guardrails/mask-batch/route'
 
 const mockCheckInternalAuth = hybridAuthMockFns.mockCheckInternalAuth
@@ -51,4 +52,20 @@ describe('POST /api/guardrails/mask-batch', () => {
 
     expect(res.status).toBe(status)
   })
+
+  it('splits a text too long for one NER pass before calling Presidio, then rejoins it', async () => {
+    presidioFetch.mockImplementation(async (_url: string, init: { body: string }) => {
+      const { texts } = JSON.parse(init.body) as { texts: string[] }
+      return Response.json({ texts: texts.map((t) => t.replaceAll('Ada', '<PERSON>')) })
+    })
+    const text = 'Ada wrote this line.\n'.repeat(60_000)
+
+    const res = await POST(createMockRequest('POST', { texts: [text], entityTypes: ['PERSON'] }))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ masked: [text.replaceAll('Ada', '<PERSON>')] })
+    const sent = presidioFetch.mock.calls.flatMap(([, init]) => JSON.parse(init.body).texts)
+    expect(sent.length).toBeGreaterThan(1)
+    for (const piece of sent) expect(piece.length).toBeLessThanOrEqual(PII_MAX_TEXT_CHARS)
+  })
 })
@@ -16,6 +16,7 @@ vi.mock('@/lib/auth/internal', () => authInternalMock)
 vi.mock('@sim/utils/helpers', () => utilsHelpersMock)
 
 import { maskPIIBatchViaHttp } from '@/lib/guardrails/mask-client'
+import { PII_MAX_TEXT_CHARS } from '@/lib/guardrails/pii-batching'
 import { POST as maskBatchRoute } from '@/app/api/guardrails/mask-batch/route'
 
 const mockSleep = utilsHelpersMockFns.mockSleep
@@ -73,6 +74,87 @@ describe('maskPIIBatchViaHttp', () => {
     expect(mockSleep).toHaveBeenCalledTimes(7)
   })
 
+  it('stops after three attempts on a persistent 500, which can be a deterministic input failure', async () => {
+    fetchMock.mockImplementation(async () => new Response('failed', { status: 500 }))
+
+    await expect(maskPIIBatchViaHttp(['a'], [])).rejects.toThrow(/mask-batch request failed/)
+    expect(fetchMock).toHaveBeenCalledTimes(3)
+    expect(mockSleep).toHaveBeenCalledTimes(2)
+  })
+
+  describe('with a text longer than one Presidio pass allows', () => {
+    /** Each request masks `Ada` to `<PERSON>`, so pieces rejoin to the masked whole. */
+    const maskingAda = () =>
+      fetchMock.mockImplementation(async (_url: string, init: { body: string }) => {
+        const { texts } = JSON.parse(init.body) as { texts: string[] }
+        return Response.json({ masked: texts.map((t) => t.replaceAll('Ada', '<PERSON>')) })
+      })
+    const sentPieces = () =>
+      fetchMock.mock.calls.flatMap(([, init]) => JSON.parse(init.body).texts as string[])
+
+    it('sends newline-aligned pieces within the limit and rejoins the masked result', async () => {
+      maskingAda()
+      const text = Array.from({ length: 60_000 }, (_, i) => `row ${i} owner Ada\n`).join('')
+
+      const { masked } = await maskPIIBatchViaHttp([text, 'short Ada'], ['PERSON'])
+
+      expect(masked).toEqual([text.replaceAll('Ada', '<PERSON>'), 'short <PERSON>'])
+      const pieces = sentPieces().filter((p) => p !== 'short Ada')
+      expect(pieces.length).toBeGreaterThan(1)
+      expect(pieces.join('')).toBe(text)
+      for (const piece of pieces) expect(piece.length).toBeLessThanOrEqual(PII_MAX_TEXT_CHARS)
+      for (const piece of pieces.slice(0, -1)) expect(piece.endsWith('\n')).toBe(true)
+    })
+
+    it('cuts minified JSON at punctuation so no email is split across pieces', async () => {
+      maskingAda()
+      const record = '{"email":"ada.lovelace@example.com","id":1234}'
+      const text = `[${Array.from({ length: 25_000 }, () => record).join(',')}]`
+
+      await maskPIIBatchViaHttp([text], ['EMAIL_ADDRESS'])
+
+      const pieces = sentPieces()
+      expect(pieces.length).toBeGreaterThan(1)
+      const emailsSent = pieces.reduce(
+        (count, piece) => count + piece.split('ada.lovelace@example.com').length - 1,
+        0
+      )
+      expect(emailsSent).toBe(25_000)
+    })
+
+    it('never splits a surrogate pair when the text has nothing to cut at', async () => {
+      // One leading unit puts a high surrogate exactly where a hard cut would land.
+      const text = `a${'\u{1F600}'.repeat(PII_MAX_TEXT_CHARS)}`
+
+      const { masked } = await maskPIIBatchViaHttp([text], [])
+
+      const pieces = sentPieces()
+      expect(pieces.length).toBeGreaterThan(1)
+      expect(pieces.join('')).toBe(text)
+      expect(masked).toEqual([`M(${pieces.join(')M(')})`])
+    })
+
+    it('replaces the whole text when any one of its pieces fails', async () => {
+      const text = `${'safe line\n'.repeat(120_000)}poison`
+      fetchMock.mockImplementation(async (_url: string, init: { body: string }) => {
+        const { texts } = JSON.parse(init.body) as { texts: string[] }
+        if (texts.some((t) => t.endsWith('poison'))) return new Response('no', { status: 422 })
+        return Response.json({ masked: texts })
+      })
+
+      const { masked, scrubbedCount } = await maskPIIBatchViaHttp(
+        [text],
+        [],
+        undefined,
+        undefined,
+        { failedChunkPlaceholder: '[FAILED]' }
+      )
+
+      expect(masked).toEqual(['[FAILED]'])
+      expect(scrubbedCount).toBe(1)
+    })
+  })
+
   describe('with a failed-chunk placeholder', () => {
     const PLACEHOLDER = '[FAILED]'
     const CHUNK_SIZE = 2000
 
@@ -8,7 +8,7 @@ import { generateInternalToken } from '@/lib/auth/internal'
 import { env } from '@/lib/core/config/env'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
-import { chunkIndicesByBudget } from '@/lib/guardrails/pii-batching'
+import { chunkIndicesByBudget, joinSegments, segmentTexts } from '@/lib/guardrails/pii-batching'
 import type { CustomPiiPattern } from '@/lib/guardrails/pii-entities'
 
 const logger = createLogger('PiiMaskClient')
@@ -36,6 +36,15 @@ const CHUNK_CONCURRENCY = env.PII_MASK_CHUNK_CONCURRENCY ?? 64
  */
 const MAX_CHUNK_ATTEMPTS = 8
 
+/**
+ * Attempts for a chunk the route answers with a 500. The route keeps 503 for a
+ * Presidio outage and 422 for input Presidio refused, so a 500 is an unclassified
+ * failure that may be deterministic for this input: two retries cover a one-off
+ * crash without spending the full outage budget resending input that fails the
+ * same way every time.
+ */
+const MAX_ATTEMPTS_AFTER_SERVER_ERROR = 3
+
 const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504])
 
 class MaskChunkHttpError extends Error {
@@ -97,9 +106,9 @@ function isOutageError(error: unknown): boolean {
 
 interface MaskPIIBatchOptions {
   /**
-   * When set, a chunk that cannot be masked has each of its strings replaced with
-   * this value instead of rejecting the call, so one bad chunk costs only its own
-   * strings. After an outage (see {@link OUTAGE_STATUSES}) exhausts a chunk's
+   * When set, a chunk that cannot be masked has every string with a piece in it
+   * replaced with this value instead of rejecting the call, so one bad chunk costs
+   * only its own strings. After an outage (see {@link OUTAGE_STATUSES}) exhausts a chunk's
    * retries, chunks not yet sent are replaced the same way.
    */
   failedChunkPlaceholder?: string
@@ -118,7 +127,9 @@ interface MaskPIIBatchResult {
  * Only the app task reaches the Presidio service (it holds `PII_URL`), but the
  * log-redaction persist path also runs inside the trigger.dev runtime — so
  * redaction always routes through HTTP, the same way the guardrails tool does.
- * Strings are grouped into byte/count-budgeted chunks (keeping each request far
+ * A string too long for one NER pass is cut into pieces first (see
+ * {@link segmentTexts}), so no request carries a text Presidio would refuse.
+ * Pieces are grouped into byte/count-budgeted chunks (keeping each request far
  * under the 10MB Next body limit) and the chunks are sent with bounded
  * concurrency, so a large payload fans out rather than serializing; order is
  * preserved, so the returned `masked` array matches `texts` length.
@@ -141,38 +152,47 @@ export async function maskPIIBatchViaHttp(
 
   const url = `${getInternalApiBaseUrl()}/api/guardrails/mask-batch`
   const placeholder = options.failedChunkPlaceholder
-  const masked = new Array<string>(texts.length)
+  const { segments, owners } = segmentTexts(texts)
+  const maskedSegments = new Array<string>(segments.length)
+  const scrubbedTexts = new Set<number>()
   let serviceUnavailable = false
-  let scrubbedCount = 0
   let firstFailure: unknown
 
-  const scrubChunk = (indices: number[], value: string) => {
-    for (const i of indices) masked[i] = value
-    scrubbedCount += indices.length
+  const scrubChunk = (indices: number[]) => {
+    for (const k of indices) scrubbedTexts.add(owners[k])
   }
 
-  await mapWithConcurrency(chunkIndicesByBudget(texts), CHUNK_CONCURRENCY, async (indices) => {
+  await mapWithConcurrency(chunkIndicesByBudget(segments), CHUNK_CONCURRENCY, async (indices) => {
     if (serviceUnavailable && placeholder !== undefined) {
-      scrubChunk(indices, placeholder)
+      scrubChunk(indices)
       return
     }
     try {
-      const chunk = indices.map((i) => texts[i])
+      const chunk = indices.map((k) => segments[k])
       const out = await postChunk(url, chunk, entityTypes, language, customPatterns)
       if (out.length !== chunk.length) {
         throw new Error('PII mask-batch returned an unexpected result')
       }
-      indices.forEach((originalIndex, k) => {
-        masked[originalIndex] = out[k]
+      indices.forEach((segmentIndex, k) => {
+        maskedSegments[segmentIndex] = out[k]
       })
     } catch (error) {
       if (placeholder === undefined) throw error
       if (isOutageError(error)) serviceUnavailable = true
       firstFailure ??= error
-      scrubChunk(indices, placeholder)
+      scrubChunk(indices)
     }
   })
 
+  const joined = joinSegments(maskedSegments, owners, texts.length)
+  // A text with any unmasked piece is replaced whole: its other pieces are masked,
+  // but keeping them would persist a fragment around the hole.
+  const masked =
+    placeholder === undefined
+      ? joined
+      : joined.map((text, i) => (scrubbedTexts.has(i) ? placeholder : text))
+  const scrubbedCount = scrubbedTexts.size
+
   if (scrubbedCount > 0) {
     logger.error('PII masking failed for some chunks; replaced their strings', {
       error: getErrorMessage(firstFailure),
@@ -196,7 +216,11 @@ async function postChunk(
     try {
       return await postChunkOnce(url, texts, entityTypes, language, customPatterns)
     } catch (error) {
-      if (attempt >= MAX_CHUNK_ATTEMPTS || !isRetryableChunkError(error)) {
+      const maxAttempts =
+        error instanceof MaskChunkHttpError && error.status === 500
+          ? MAX_ATTEMPTS_AFTER_SERVER_ERROR
+          : MAX_CHUNK_ATTEMPTS
+      if (attempt >= maxAttempts || !isRetryableChunkError(error)) {
         throw error
       }
       const retryAfterMs = error instanceof MaskChunkHttpError ? error.retryAfterMs : null