Update State

Founder-granted capabilities. Conservative defaults; unknown keys rejected so a typo can't silently grant nothing (or worse, be read as a wider grant by a future field of that name).