Tier-1 capabilities require a short-lived elevation token (step-up re-auth) on top of the role — the same second factor the console uses today for destructive actions.

Every name and pack ID on this screen is synthetic. This repo publishes — main is production, no build step — so a real pack ID beside a real name would put the exact mapping this screen exists to protect onto a static site. Prototypes get invented data; the register is the only place the real mapping lives.

Pack IDs stay opaque. Six characters, A–Z0–9 — never a name, initials, or firm, in a URL, page title, filename, or log line. The pack ↔ person mapping exists in the register and the Access policy, nowhere else. T. Abiodun shows the rule that exemption never rewrites history: access is revoked, the signed v1.1 acceptance row stays forever.

Residency. Executed NDA PDFs are user-owned bytes — fetched through storage.get_storage(region) with the region resolved from the owner's account, failing closed when a region isn't ready. Never a fallback to another region's bucket.

No new document type is needed. The platform-side obligation is the Terms of Service, not an MSA — and every user already accepts it at activation (tos_accepted → registration_metadata, text at relayctx.com/terms). NDA already applies to everyone. So the entire change is one line of meaning: EAPA becomes product-lens only.

Two things follow. The ToS is a different mechanism — an unversioned checkbox, so a terms change re-consents nobody and the text signed isn't recoverable from the record, unlike legal_acceptances which is version-keyed and hashed. Real gap, whole user base, separate issue — not this one. And BPA is labelled "Platform Agreement" in DOC_LABELS while the signing flow says EAPA "Replaces Beta Participant Agreement (BPA)" — a retired type wearing the name of the live platform terms. Relabel and mark retired before that reading sticks.

Why this is not a switch in the gate component. The signing gate renders what GET /api/legal/pending returns — it decides nothing. Skipping EAPA client-side leaves gate_needed() returning true at seven server call sites (login, user API, MCP writes) while the screen meant to unblock the user shows nothing to sign. That is the gate loop the code already carries a warning comment about. Applicability belongs on the document version, resolved once, server-side, and read by every caller.

Fail posture splits by tier. gate_needed fails open today so a database blip can't lock everyone out of login — right for EAPA, wrong for an NDA guarding the room. NDA-tier applicability fails closed. · Onboarding takes the same lens. The curriculum is single-track today; an investor enrolled into it gets taught to claim Codes, plus EAP graduation sweeps and registration reminders. · Revocation is still two systems — clearing the lens does not empty the Cloudflare Access policy on that pack, so revoke surfaces it as an explicit, evidenced step.