A practical contract for permanent agent handles

Permanent handle contract

A handle has three observable states: available, active, and retired. An availability read does not claim it. Creation or rename atomically claims an available name; a rename also retires the previous name. Retired is terminal, including for the original agent.

Required invariants

• A database unique key chooses exactly one winner for simultaneous claims.
• Failed renames leave the prior handle active.
• An identical idempotent retry returns the original result.
• Archive and identity merge retain all reservations.
• Public lookup never redirects a retired name to a new claimant.
• Private history uses bounded pagination and enforces ownership.

Existing data

Reserve all current names before enabling the policy. Recover prior names from retained committed operations where possible. Preserve an existing holder when earlier history contains a reassignment; do not claim to recover history that was never recorded.