admission that proves work before access
The easy way to admit a participant is one gate and one credential: pay the price, get a key. The design record refuses that, because a single gate forces a choice between two bad options — cheap enough that anyone can flood in, or…