Important architecture rule: keep combat logic server-authoritative and separate from monetization, VIP, and admin tools. Bombs, explosions, powerups, and deaths should only read validated player state; they should never directly process purchases or UI behavior.