DL-269

Every request-input account field on the compass proto contract is handle-typed; the Server resolves handle→account_id at the service edge (the from_handle posture generalized). An unresolvable, invisible, foreign, or wrong-subtype handle is ONE indistinguishable in-band NOT_FOUND naming the submitted handle — the oracle invariant that forbids a caller distinguishing “exists under another owner” from “no such handle” (the ReparentAgent foreign-parent leg mirrors CreateAgent’s same-owner edge pre-check to hold this). No agent or client UI ever resolves an id.

Status: Active (Matt, 2026-08-27)

Record: ../../server/compass-handle-addressing-cutover/design.md#ledger-impact