{cannot} is {can} turned round: the content renders when the gate answers no, and the part after its own {else} - or the @else@ half - when it answers yes. Everything else is the same: the first item is the ability, the others what the gate is given, an enclosing loop's name its current row.

A guest is refused by every gate that does not take NULL for its user, so for a guest {cannot} renders its content for those. An ability nobody defined counts as no - and is an error under the strict check, as with {can}.