PASS: Approval ID generation
PASS: Approved-root file boundary
PASS: Expiring download token generation
PASS: Atomic approval storage prerequisites