fail at config
per-channel default ACLs
I REALLY DO TEST IN NON-PRODUCTION
fix _lots_ of stuff with my shiny new dependency resolution system