a reference is not a claim

The failure that drove this decision is worth stating in its own terms. A record points at another record by its content identity, and identity looks like proof. It is not. Anyone can build a registry of their own and assert that a given object belongs to them, and the holder of the target has no way to answer which registry that is, or who gave it standing here.

The tension is cheap references against attributable ones. The cheap form is one opaque value: no context, and no way to separate a legitimate reference from a claim invented minutes ago on a chain nobody has heard of.

The decision is that every cross-boundary reference carries a path, and the path is walked from the top. A reference becomes the identity plus a route — which world, which core that world declares, which chain inside that core, which object — and every step is checked against the catalog, so a reference is verified by traversal rather than by trusting whoever wrote it. The same record explains why softer controls were rejected: if abuse only costs an attacker its tenants, that argument fails against a newcomer with nothing to lose, so the property chosen does not depend on what the attacker stands to forfeit.

What it costs is longer references and slower resolution, softened by caching routes that cannot change, plus a fallback where two worlds attest each other's declarations. What it proves is that the team separates a pointer from evidence of custody.