Protected report library

See the report's real state.

Pending work stays pending. A failed record is not labelled as a download. Only a delivered owner-gated record exposes its downloadUrl.