The gates in front of destructive operations exist to stop mistakes
(stale rosters, typos, racing hosts); stopping a malicious group
member is a side effect, not the design goal. Written into README
§Security and the man page so future checks are judged by that bar.
ROADMAP.md captures the direction: social features (knock, log,
clean) over further hardening, plus the explicit resist list.
