Cloning is cheapA skimmer standing next to a rider can copy a legacy card in well under a minute. The defence cannot assume the media is trustworthy.
Offline is the gapA tunnel outage turns every gate into an island. That is precisely when a clone pays off, and precisely when legacy systems stop looking.
Reconciliation closes itGates buffer, then merge. One card at two stations nine seconds apart is arithmetic, not judgement — so the deny-list is signed and pushed automatically.