Download filename uses the report UID (not the student's name); same UID shared with the DB submission

app.py

@@ -247,18 +247,25 @@ if uploaded is not None and consent:
             st.info("Part of your name might still show up inside a course title — "
                     "we'll double-check that on our end.")
 
-        stem = os.path.splitext(uploaded.name)[0]
-        stem = stem.replace("DONOTSHARE_", "").replace("REDACTED_", "")
+        # One stable ID per uploaded file, shared by the download filename AND
+        # the database submission — so the filename never contains the student's
+        # name, and the file they keep matches what we store.
+        file_key = getattr(uploaded, "file_id", None) or f"{uploaded.name}:{uploaded.size}"
+        if st.session_state.get("uid_key") != file_key:
+            st.session_state["uid_key"] = file_key
+            st.session_state["uid"] = uuid.uuid4().hex[:8].upper()
+        uid = st.session_state["uid"]
+
         st.download_button("⬇️ Download my redacted report", data=out,
-                           file_name=f"REDACTED_{stem}.pdf",
+                           file_name=f"REDACTED_{uid}.pdf",
                            mime="application/pdf")
-        st.caption("Open it to make sure it looks right — then submit it below.")
+        st.caption(f"Saved as `REDACTED_{uid}.pdf` — that code is your report ID. "
+                   "Open it to check it looks right, then submit below.")
 
         st.divider()
         if _submissions_enabled():
             st.markdown("**Share it with BBH**")
             if st.button("📤 Submit my redacted report"):
-                uid = uuid.uuid4().hex[:8].upper()
                 try:
                     _upload_submission(out, uid)
                     st.success("Submitted — thank you so much! 🎉")