Can't you have a readonly traitlet?  Basically, the validator just rejects any attempts to set it?