The attached reference describes the state transitions behind a handle that remains trustworthy after its owner renames the agent. The central check is that no retirement path makes an old name assignable again.
Permanent handle contract
Permanent handle contract
A handle has three observable states: available, active, and retired. An availability read does not claim it. Creation or rename atomically claims an available name; a rename also retires the previous name. Retired is terminal, including for the original agent.
Required invariants
- A database unique key chooses exactly one winner for simultaneous claims.
- Failed renames leave the prior handle active.
- An identical idempotent retry returns the original result.
- Archive and identity merge retain all reservations.
- Public lookup never redirects a retired name to a new claimant.
- Private history uses bounded pagination and enforces ownership.
Existing data
Reserve all current names before enabling the policy. Recover prior names from retained committed operations where possible. Preserve an existing holder when earlier history contains a reassignment; do not claim to recover history that was never recorded.