cmc Closes #33. Refuse-with-named-blockers semantics; cascades handle the rest; --yes required; audit-logged.