Server-authoritative by construction
Clients send intents, never state. Every intent passes a fail-closed validation chain — a crashing validator rejects the action, and a channel with no validator rejects everything. Missing permission is not permission.