I spent the weekend trying to make a thing move on one machine and have it appear on another, which is the entire premise of multiplayer and also, it turns out, a wall you walk into face-first the first time. Unreal's replication model in UE4 is powerful and mostly sensible, but it does not let you be vague about who owns what.
My mistake was the obvious one. I marked a variable Replicated, changed it on the client, and waited for the server to notice. It didn't, of course. Replication flows from the server out to clients, full stop. The client doesn't get to just set a replicated property and have it propagate. If a client wants to change authoritative state, it asks the server to do it, with a Server RPC, and the server, if it agrees, changes the variable and lets replication push it back out.
UPROPERTY(ReplicatedUsing = OnRep_Health)
float Health;
UFUNCTION(Server, Reliable, WithValidation)
void ServerApplyDamage(float Amount);
Once I stopped fighting it, the shape made sense. The server is the authority. Clients send requests and receive truth. The ReplicatedUsing callback fires on clients when the value lands, which is where your healthbar updates rather than in Tick. And you still have to list every replicated property in GetLifetimeReplicatedProps, which I forgot, which is why nothing replicated for the first hour.
It clicked when I reframed it as a server with thin clients rather than peers gossiping. Obvious in hindsight, like most things that take a weekend. The cheating-resistance you get for free is just the authority model doing its job.