cardano-keri's ruling gives the registry to identity uniqueness, and epic 16 executed the correction: a permissionless ledger cannot prohibit a rival registry (naming-correspondence.md, "What t50 settled"). Canonical identity is therefore a /derivation the consumer authenticates/, not a refusal the chain performs: the canonical registry token's name is SHA-256 of the canonical seed's outRef, that seed can never be spent twice, and a rival from another seed can never carry that name.

This module is the pure decision core the devnet rows execute. It never talks to the chain; the runner feeds it assets read back from chain UTxOs at the derived address. Two decisions exist on purpose:

• authenticate — the consumer's check: exact policy, the derived name, quantity one.
• authenticateWeak — the policy-address-only-authentication-control control: policy only (the address leg is the query itself). It is designed to accept a consistent rival, which is what makes rival-seed-authentication's rejection attributable to the name check and nothing else. A control that could not accept would prove nothing.