Runs once per accepted update; may run steps.
Optional
Runs first; throw (or return a string) to refuse. A refusal records nothing.
Runs once per accepted update; may run steps.