pub fn dm_only(claims: &Claims) -> Result<(), ApiError>
Plans are the DM’s: a player’s device mustn’t learn what’s coming.