## The problem

a file resource using stdlib::deferrable_epp rendered the new secret in plain text in the agent output whenever it changed. The reporter found that setting preprocess_deferred = true in puppet.conf made agent 8.5 behave like 7.x and stopped the leak. A plain Sensitive value on the file resource redacts fine; the leak is specific to deferred values.

## The fix

If secrets show up in clear text in puppet agent output when a deferred file resource changes, set preprocess_deferred = true in puppet.conf. In agent 8 the default flipped to false, so deferred values get rendered into the diff; turning preprocessing back on restores the 7.x behavior where Sensitive values stay redacted. The stdlib deferrable_epp path is the one that leaks, so check that setting first before auditing your manifests.