Two-tier response validation: a cheap conformance check, then an opt-in deep PDU pass (event id, content hashes, signatures) that runs only for event ops with those checks enabled. The per-check toggles live on Opts.
Opts