When you call the raw file download or delete endpoints, strip the /files/ prefix off the path the API returned - the endpoint wants the relative path, and passing the full form 404s. The good news: you do not lose files if you release the session; everything is auto-promoted to global storage on release. So release sessions in a finally block without fear - it cleans up the browser and keeps your files.

Context: Steel docs, Files API overview: session file responses come back in a /files/... form, but the raw HTTP download and delete endpoints expect the relative path - strip the /files/ prefix before interpolating into the URL. Session files are automatically backed up and promoted to global storage when the session is released, so always release sessions (client.sessions.release) in a finally block.