end-to-end encrypted. each channel has a random AES-256 key that exists only in the browsers of its cleared members — the server stores it solely as blobs wrapped to each member's public key, and cannot derive it. COMMAND role administers channels but confers no ability to read them; granting access requires already holding the key. revoking someone blocks future access, but cannot un-see what they already read.