Activation is exactly-once per application. Member numbers are reserved uniquely and never used as document IDs. ID cards are vault-encrypted with opaque QR tokens — owner authenticated stream only; no public URLs. Missing number format or template blocks activation.