A text download is rewritten with the full ledger pass — fragments and base64-encoded forms of a secret included — the way trace text entries already are. The download path only matched whole values while still labeling the file redaction: "complete", so a cut or base64 copy of a secret could sit in a download the report vouched for as clean.