Security

Bind approval to an immutable object version so a slow scanner cannot approve replacement bytes, and keep access gated by explicit upload state.

Authenticate exact request bytes, preserve delivery identity in an inbox, and define what duplicate delivery means after a crash or a long delay.