The identity contract.

A bare integer handle is enough inside one process and fails the moment it leaves. The branded contract is best read as four answers to four of those failures, each property earning its place by retiring a specific weakness.

The integer is untyped — nothing stops a portfolio id being passed where an order id belongs — and the namespace fixes it: three characters declare the domain class on the wire and to the type system, and the gate refuses a foreign one before a handler runs. The integer has no inherent order across systems; the contract’s order theorem gives it one, because the name’s lexicographic order is its mint order, and a table keyed by it is a timeline.

The integer needs a side table to say where its row lives; the contract carries placement in the value — hash32 locates a row from the identity alone, and placement(USR0KHTOWnGLuC) is 234878118, the same on every holder and on both the native and pure code paths. And the integer means different things in different languages; the canon — one source, one vector file — makes encode and decode identical across five runtimes, so the runtime is a deployment detail. The self-check asserts the native and pure paths agree at boot, or the system refuses to start.

placement(USR0KHTOWnGLuC)        →  234878118            native and pure agree
parse(USR0NgWEfAEJfs)            →  {:ok, "USR", 320636799581945856}
decode(USRzzzzzzzzzzz)           →  :error               an overflow is refused, not wrapped